@promptowl/contextnest-community 1.5.0 → 1.7.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-IWA2UDAT.js";
+} from "./chunk-MOXICJPD.js";
 import {
   checkConflict,
   createVersion,
@@ -25,7 +25,7 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-HIH7I232.js";
+} from "./chunk-VD5QX2ZQ.js";
 import {
   AppError,
   ConflictError,
@@ -35,10 +35,10 @@ import {
   ValidationError,
   canCreateInNest,
   canManageStewards,
-  canManageWith,
   canUserAccess,
   canUserApprove,
   canUserEdit,
+  collabPermToRole,
   createNest,
   createStewardRecord,
   deleteNest,
@@ -65,9 +65,11 @@ import {
   listStewards,
   loadAccessConfig,
   nestAllowsSelfApprove,
+  nestStorageRoot,
   permissionLevel,
   removeSteward,
   renameNest,
+  resolveNestPath,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
@@ -82,13 +84,18 @@ import {
   updateSteward,
   upsertEnvVar,
   validateLicense
-} from "./chunk-EMOE53KX.js";
+} from "./chunk-43DOX4LH.js";
 import {
-  ANON_EMAIL,
-  ANON_USER_ID,
   config,
-  getDb
-} from "./chunk-RMU3LOPH.js";
+  getDb,
+  initDb,
+  insertOrIgnore,
+  nowExpr
+} from "./chunk-QMLAXQES.js";
+import {
+  ANON_EMAIL,
+  ANON_USER_ID
+} from "./chunk-SLTQACJW.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -116,37 +123,40 @@ function newSessionId() {
 function expiryIso(ttlSeconds = SESSION_TTL_SECS) {
   return new Date(Date.now() + ttlSeconds * 1e3).toISOString();
 }
-function createSession(userId, userAgent) {
+async function createSession(userId, userAgent) {
   const db = getDb();
   const id = newSessionId();
-  db.prepare(
+  await db.run(
     `INSERT INTO sessions (id, user_id, expires_at, user_agent)
-     VALUES (?, ?, ?, ?)`
-  ).run(id, userId, expiryIso(), userAgent || null);
+     VALUES (?, ?, ?, ?)`,
+    [id, userId, expiryIso(), userAgent || null]
+  );
   return id;
 }
-function resolveSession(id) {
+async function resolveSession(id) {
   const db = getDb();
-  const row = db.prepare(
-    `SELECT user_id, expires_at FROM sessions WHERE id = ?`
-  ).get(id);
+  const row = await db.get(
+    `SELECT user_id, expires_at FROM sessions WHERE id = ?`,
+    [id]
+  );
   if (!row) return null;
   if (new Date(row.expires_at).getTime() <= Date.now()) {
-    db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+    await db.run("DELETE FROM sessions WHERE id = ?", [id]);
     return null;
   }
-  db.prepare(
-    "UPDATE sessions SET last_seen_at = datetime('now') WHERE id = ?"
-  ).run(id);
+  await db.run(
+    `UPDATE sessions SET last_seen_at = ${nowExpr(db)} WHERE id = ?`,
+    [id]
+  );
   return row.user_id;
 }
-function deleteSession(id) {
+async function deleteSession(id) {
   const db = getDb();
-  db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+  await db.run("DELETE FROM sessions WHERE id = ?", [id]);
 }
-function deleteAllSessionsForUser(userId) {
+async function deleteAllSessionsForUser(userId) {
   const db = getDb();
-  db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+  await db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);
 }
 function getSessionIdFromRequest(c) {
   const cookieHeader = c.req.header("Cookie");
@@ -190,7 +200,7 @@ var authMiddleware = createMiddleware(async (c, next) => {
   const db = getDb();
   const sessionId = getSessionIdFromRequest(c);
   if (sessionId) {
-    const userId = resolveSession(sessionId);
+    const userId = await resolveSession(sessionId);
     if (userId) {
       c.set("userId", userId);
       c.set("nestScope", null);
@@ -200,11 +210,15 @@ var authMiddleware = createMiddleware(async (c, next) => {
   const key = parseBearerToken(c.req.header("Authorization"));
   if (key) {
     const keyHash = hashApiKey(key);
-    const record = db.prepare("SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?").get(keyHash);
+    const record = await db.get(
+      "SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?",
+      [keyHash]
+    );
     if (record) {
-      db.prepare(
-        "UPDATE api_keys SET last_used_at = datetime('now') WHERE key_hash = ?"
-      ).run(keyHash);
+      await db.run(
+        `UPDATE api_keys SET last_used_at = ${nowExpr(db)} WHERE key_hash = ?`,
+        [keyHash]
+      );
       c.set("userId", record.user_id);
       c.set("nestScope", record.nest_id);
       return next();
@@ -327,27 +341,30 @@ function clientIp(c) {
   }
   return "unknown";
 }
-function resolveCallerUserId(c) {
+async function resolveCallerUserId(c) {
   const sessionId = getSessionIdFromRequest(c);
   if (sessionId) {
-    const uid = resolveSession(sessionId);
+    const uid = await resolveSession(sessionId);
     if (uid) return uid;
   }
   const key = parseBearerToken(c.req.header("Authorization"));
   if (key) {
     const db = getDb();
-    const row = db.prepare("SELECT user_id FROM api_keys WHERE key_hash = ?").get(hashApiKey(key));
+    const row = await db.get(
+      "SELECT user_id FROM api_keys WHERE key_hash = ?",
+      [hashApiKey(key)]
+    );
     if (row) return row.user_id;
   }
   return null;
 }
-function deviceGateBlocked(c) {
+async function deviceGateBlocked(c) {
   const gate = config.PROMPTOWL_SIGN_IN_GATE;
   if (gate === "open") return null;
   const error = "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.";
   if (gate === "disabled") return { error, gate };
-  const callerId = resolveCallerUserId(c);
-  if (callerId && !isLicenseAdminUserId(callerId)) return { error, gate };
+  const callerId = await resolveCallerUserId(c);
+  if (callerId && !await isLicenseAdminUserId(callerId)) return { error, gate };
   return null;
 }
 function setSessionCookie(c, sessionId) {
@@ -376,13 +393,17 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
   }
   const db = getDb();
   const meEmail = normalizeEmail(rawEmail);
-  let user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = ?").get(meEmail);
+  let user = await db.get(
+    "SELECT id, email, name FROM users WHERE LOWER(email) = ?",
+    [meEmail]
+  );
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, meEmail, rawName || null, placeholderHash);
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+      [userId, meEmail, rawName || null, placeholderHash]
+    );
     user = { id: userId, email: meEmail, name: rawName || null };
     trackEvent("user.register", {
       userId,
@@ -406,7 +427,7 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
       license_owner_email: lic.ownerEmail
     };
   }
-  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  const sessionId = await createSession(user.id, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
   return { ok: true, user, isAdmin, claimBlocked };
 }
@@ -423,25 +444,30 @@ authRoutes.post("/register", async (c) => {
     return c.json({ error: "Too many registration attempts, try again later" }, 429);
   }
   const db = getDb();
-  const existing = db.prepare("SELECT id, is_invited FROM users WHERE LOWER(email) = ?").get(email);
+  const existing = await db.get(
+    "SELECT id, is_invited FROM users WHERE LOWER(email) = ?",
+    [email]
+  );
   let userId;
   const passwordHash = await hashPassword(body.password);
   if (existing && existing.is_invited === 1) {
     userId = existing.id;
-    db.prepare(
-      "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?"
-    ).run(passwordHash, body.name || null, userId);
+    await db.run(
+      "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?",
+      [passwordHash, body.name || null, userId]
+    );
     trackEvent("user.register", { userId, email, claimed: true });
   } else if (existing) {
     throw new ValidationError("Email already registered");
   } else {
     userId = uuid();
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, email, body.name || null, passwordHash);
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+      [userId, email, body.name || null, passwordHash]
+    );
     trackEvent("user.register", { userId, email });
   }
-  const sessionId = createSession(userId, c.req.header("User-Agent"));
+  const sessionId = await createSession(userId, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
   return c.json(
     {
@@ -461,7 +487,7 @@ authRoutes.post("/login", async (c) => {
     throw new ValidationError("email and password are required");
   }
   const ip = clientIp(c);
-  const emailLower = body.email.toLowerCase();
+  const emailLower = normalizeEmail(body.email);
   const hasIp = ip !== "unknown";
   const ipKey = `login:ip:${ip}`;
   const emailKey = `login:email:${emailLower}`;
@@ -469,9 +495,10 @@ authRoutes.post("/login", async (c) => {
     return c.json({ error: "Too many login attempts, try again later" }, 429);
   }
   const db = getDb();
-  const user = db.prepare(
-    "SELECT id, email, name, password_hash, is_admin FROM users WHERE LOWER(email) = ?"
-  ).get(emailLower);
+  const user = await db.get(
+    "SELECT id, email, name, password_hash, is_admin, is_invited FROM users WHERE LOWER(email) = ?",
+    [emailLower]
+  );
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
     if (hasIp) recordFailure(ipKey, LOGIN_LIMIT);
@@ -482,18 +509,24 @@ authRoutes.post("/login", async (c) => {
   console.log(`[auth] login OK \u2014 counter reset ip=${ip} email=${emailLower}`);
   if (hasIp) clear(ipKey);
   clear(emailKey);
+  if (user.is_invited === 1) {
+    try {
+      await db.run("UPDATE users SET is_invited = 0 WHERE id = ?", [user.id]);
+    } catch {
+    }
+  }
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
-      db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+      await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
         newHash,
         user.id
-      );
+      ]);
     } catch {
     }
   }
   trackEvent("user.login", { userId: user.id });
-  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  const sessionId = await createSession(user.id, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
   return c.json({
     user: {
@@ -506,7 +539,7 @@ authRoutes.post("/login", async (c) => {
 });
 authRoutes.post("/logout", async (c) => {
   const sessionId = getSessionIdFromRequest(c);
-  if (sessionId) deleteSession(sessionId);
+  if (sessionId) await deleteSession(sessionId);
   clearSessionCookie(c);
   return c.json({ ok: true });
 });
@@ -516,7 +549,10 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   );
   const db = getDb();
   const userId = c.get("userId");
-  const existing = db.prepare("SELECT key_prefix FROM api_keys WHERE user_id = ?").get(userId);
+  const existing = await db.get(
+    "SELECT key_prefix FROM api_keys WHERE user_id = ?",
+    [userId]
+  );
   if (existing) {
     return c.json(
       {
@@ -528,15 +564,16 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
-  ).run(
-    keyId,
-    userId,
-    hashApiKey(apiKey),
-    getKeyPrefix(apiKey),
-    body.nest_id || null,
-    body.label || null
+  await db.run(
+    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
+    [
+      keyId,
+      userId,
+      hashApiKey(apiKey),
+      getKeyPrefix(apiKey),
+      body.nest_id || null,
+      body.label || null
+    ]
   );
   return c.json(
     { api_key: apiKey, key_prefix: getKeyPrefix(apiKey) },
@@ -551,39 +588,47 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   const userId = c.get("userId");
   const apiKey = generateApiKey();
   const keyId = uuid();
-  const prior = db.prepare("SELECT label, nest_id FROM api_keys WHERE user_id = ?").get(userId);
-  db.transaction(() => {
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(userId);
-    db.prepare(
-      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
-    ).run(
-      keyId,
-      userId,
-      hashApiKey(apiKey),
-      getKeyPrefix(apiKey),
-      body.nest_id ?? prior?.nest_id ?? null,
-      body.label ?? prior?.label ?? null
+  const prior = await db.get(
+    "SELECT label, nest_id FROM api_keys WHERE user_id = ?",
+    [userId]
+  );
+  await db.transaction(async (tx) => {
+    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [userId]);
+    await tx.run(
+      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
+      [
+        keyId,
+        userId,
+        hashApiKey(apiKey),
+        getKeyPrefix(apiKey),
+        body.nest_id ?? prior?.nest_id ?? null,
+        body.label ?? prior?.label ?? null
+      ]
     );
-  })();
+  });
   return c.json({ api_key: apiKey, key_prefix: getKeyPrefix(apiKey) });
 });
 authRoutes.get("/keys", authMiddleware, async (c) => {
   const db = getDb();
-  const keys = db.prepare(
-    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ?"
-  ).all(c.get("userId"));
+  const keys = await db.all(
+    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ?",
+    [c.get("userId")]
+  );
   return c.json({ keys });
 });
 authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
   const db = getDb();
-  const result = db.prepare("DELETE FROM api_keys WHERE id = ? AND user_id = ?").run(c.req.param("keyId"), c.get("userId"));
+  const result = await db.run(
+    "DELETE FROM api_keys WHERE id = ? AND user_id = ?",
+    [c.req.param("keyId"), c.get("userId")]
+  );
   if (result.changes === 0) {
     return c.json({ error: "Key not found" }, 404);
   }
   return c.json({ deleted: true });
 });
 authRoutes.post("/device", async (c) => {
-  const blocked = deviceGateBlocked(c);
+  const blocked = await deviceGateBlocked(c);
   if (blocked) return c.json(blocked, 403);
   if (!tryConsume(`device:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return c.json({ error: "Too many device auth attempts, try again later" }, 429);
@@ -606,7 +651,7 @@ authRoutes.post("/device", async (c) => {
   return c.json(data);
 });
 authRoutes.get("/device/poll", async (c) => {
-  const blocked = deviceGateBlocked(c);
+  const blocked = await deviceGateBlocked(c);
   if (blocked) return c.json(blocked, 403);
   const code = c.req.query("code");
   const clientSecret = c.req.query("client_secret");
@@ -689,12 +734,13 @@ authRoutes.get("/sso", async (c) => {
   }
   if (!claims.jti) return ssoError("invalid_ticket");
   const db = getDb();
-  db.prepare("DELETE FROM sso_used_jti WHERE expires_at < datetime('now')").run();
+  await db.run(`DELETE FROM sso_used_jti WHERE expires_at < ${nowExpr(db)}`);
   const expiresAtIso = new Date((claims.exp ?? 0) * 1e3).toISOString();
   try {
-    db.prepare(
-      "INSERT INTO sso_used_jti (jti, expires_at) VALUES (?, ?)"
-    ).run(claims.jti, expiresAtIso);
+    await db.run(
+      "INSERT INTO sso_used_jti (jti, expires_at) VALUES (?, ?)",
+      [claims.jti, expiresAtIso]
+    );
   } catch (err) {
     if (err?.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
       return ssoError("ticket_used");
@@ -706,7 +752,7 @@ authRoutes.get("/sso", async (c) => {
   try {
     result = await provisionPromptowlUser(c, sub, claims.name);
   } catch (err) {
-    db.prepare("DELETE FROM sso_used_jti WHERE jti = ?").run(claims.jti);
+    await db.run("DELETE FROM sso_used_jti WHERE jti = ?", [claims.jti]);
     console.error("[sso] provisioning failed; released jti for retry:", err);
     return ssoError("service_error");
   }
@@ -719,13 +765,19 @@ authRoutes.get("/admin-status", async (c) => {
   const ownerEmail = lic?.valid ? lic.ownerEmail : null;
   let admin = null;
   if (ownerEmail) {
-    const ownerRow = db.prepare("SELECT name FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1").get(ownerEmail);
+    const ownerRow = await db.get(
+      "SELECT name FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1",
+      [ownerEmail]
+    );
     admin = { email: ownerEmail, name: ownerRow?.name ?? null };
   }
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   let me = null;
   if (callerId) {
-    const row = db.prepare("SELECT email, name FROM users WHERE id = ?").get(callerId);
+    const row = await db.get(
+      "SELECT email, name FROM users WHERE id = ?",
+      [callerId]
+    );
     if (row) {
       me = {
         email: row.email,
@@ -748,7 +800,10 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   assertValidPassword(body.next, "new password");
   const db = getDb();
   const userId = c.get("userId");
-  const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
+  const user = await db.get(
+    "SELECT password_hash FROM users WHERE id = ?",
+    [userId]
+  );
   if (!user) throw new ValidationError("User not found");
   const check = await verifyPassword(body.current, user.password_hash);
   if (!check.ok) {
@@ -761,20 +816,20 @@ authRoutes.post("/password", authMiddleware, async (c) => {
     );
   }
   const newHash = await hashPassword(body.next);
-  db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+  await db.run("UPDATE users SET password_hash = ?, is_invited = 0 WHERE id = ?", [
     newHash,
     userId
-  );
-  deleteAllSessionsForUser(userId);
+  ]);
+  await deleteAllSessionsForUser(userId);
   clearSessionCookie(c);
   return c.json({ ok: true });
 });
 authRoutes.post("/admin/reset-password/:userId", async (c) => {
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json({ error: "Authentication required." }, 401);
   }
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       { error: "Only the license-admin user can reset passwords." },
       403
@@ -782,7 +837,10 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   }
   const targetId = c.req.param("userId");
   const db = getDb();
-  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  const target = await db.get(
+    "SELECT id, email FROM users WHERE id = ?",
+    [targetId]
+  );
   if (!target) return c.json({ error: "User not found" }, 404);
   let supplied;
   try {
@@ -796,29 +854,28 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   const generated = supplied ? null : uuid().replace(/-/g, "").slice(0, 16);
   const newPassword = supplied ?? generated;
   const newHash = await hashPassword(newPassword);
-  db.transaction(() => {
-    db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+  await db.transaction(async (tx) => {
+    await tx.run("UPDATE users SET password_hash = ? WHERE id = ?", [
       newHash,
       target.id
-    );
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
-  })();
-  deleteAllSessionsForUser(target.id);
+    ]);
+  });
+  await deleteAllSessionsForUser(target.id);
   trackEvent("admin.reset_password", { adminId: callerId, userId: target.id });
   return c.json({
     ok: true,
     email: target.email,
-    keys_revoked: true,
+    keys_revoked: false,
     // Plaintext returned ONCE, only when the server generated it.
     temporary_password: generated ?? void 0
   });
 });
 authRoutes.delete("/users/:userId", async (c) => {
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json({ error: "Authentication required." }, 401);
   }
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       { error: "Only the license-admin user can remove users." },
       403
@@ -829,9 +886,15 @@ authRoutes.delete("/users/:userId", async (c) => {
     return c.json({ error: "You can't remove your own admin account." }, 400);
   }
   const db = getDb();
-  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  const target = await db.get(
+    "SELECT id, email FROM users WHERE id = ?",
+    [targetId]
+  );
   if (!target) return c.json({ error: "User not found" }, 404);
-  const ownedNests = db.prepare("SELECT COUNT(*) AS c FROM nests WHERE user_id = ?").get(target.id).c;
+  const ownedNests = (await db.get(
+    "SELECT COUNT(*) AS c FROM nests WHERE user_id = ?",
+    [target.id]
+  )).c;
   if (ownedNests > 0) {
     return c.json(
       {
@@ -841,17 +904,18 @@ authRoutes.delete("/users/:userId", async (c) => {
       409
     );
   }
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM stewards WHERE user_id = ? OR lower(user_email) = lower(?)"
-    ).run(target.id, target.email);
-    db.prepare("DELETE FROM nest_collaborators WHERE user_id = ?").run(
-      target.id
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM stewards WHERE user_id = ? OR lower(user_email) = lower(?)",
+      [target.id, target.email]
     );
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
-    db.prepare("DELETE FROM users WHERE id = ?").run(target.id);
-  })();
-  deleteAllSessionsForUser(target.id);
+    await tx.run("DELETE FROM nest_collaborators WHERE user_id = ?", [
+      target.id
+    ]);
+    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [target.id]);
+    await tx.run("DELETE FROM users WHERE id = ?", [target.id]);
+  });
+  await deleteAllSessionsForUser(target.id);
   trackEvent("admin.remove_user", { adminId: callerId, userId: target.id });
   return c.json({ ok: true, email: target.email });
 });
@@ -859,7 +923,7 @@ authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
   const email = normalizeEmail(body.email);
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json(
       {
@@ -869,7 +933,7 @@ authRoutes.post("/invite", async (c) => {
     );
   }
   const db = getDb();
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       {
         error: "Only the license-admin user can invite teammates. Contact the admin who installed the PromptOwl license on this server to issue invitations."
@@ -877,41 +941,46 @@ authRoutes.post("/invite", async (c) => {
       403
     );
   }
-  let user = db.prepare("SELECT id, email FROM users WHERE LOWER(email) = ?").get(email);
-  if (!user) {
-    const userId = uuid();
-    const placeholderHash = await hashPassword(uuid());
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-    ).run(userId, email, null, placeholderHash);
-    user = { id: userId, email };
+  const existing = await db.get(
+    "SELECT id, email, is_invited FROM users WHERE LOWER(email) = ?",
+    [email]
+  );
+  if (existing && existing.is_invited === 0) {
+    return c.json(
+      {
+        error: "A user with this email already exists. Use Reset password to issue them a new password."
+      },
+      409
+    );
   }
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  db.transaction(() => {
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(user.id);
-    db.prepare(
-      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-    ).run(
-      keyId,
-      user.id,
-      hashApiKey(apiKey),
-      getKeyPrefix(apiKey),
-      body.label || "teammate"
+  const tempPassword = uuid().replace(/-/g, "").slice(0, 16);
+  const passwordHash = await hashPassword(tempPassword);
+  let userId;
+  if (existing) {
+    userId = existing.id;
+    await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
+      passwordHash,
+      userId
+    ]);
+  } else {
+    userId = uuid();
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+      [userId, email, null, passwordHash]
     );
-  })();
-  trackEvent("admin.invite", { adminId: callerId, email: body.email });
+  }
+  trackEvent("admin.invite", { adminId: callerId, email });
   return c.json(
     {
-      api_key: apiKey,
-      user: { id: user.id, email: user.email },
-      message: "Copy this key and share it securely \u2014 it won't be shown again."
+      temporary_password: tempPassword,
+      user: { id: userId, email },
+      message: "Share this temporary password securely. Your teammate signs in with their email + this password, then can change it and create their own API key."
     },
     201
   );
 });
 authRoutes.get("/teammates", async (c) => {
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json(
       {
@@ -921,7 +990,7 @@ authRoutes.get("/teammates", async (c) => {
     );
   }
   const db = getDb();
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       {
         error: "Only the license-admin user can view the teammates list. Contact the admin who installed the PromptOwl license on this server."
@@ -929,15 +998,16 @@ authRoutes.get("/teammates", async (c) => {
       403
     );
   }
-  const teammates = db.prepare(
+  const teammates = await db.all(
     `SELECT u.id, u.email, u.name, u.is_invited,
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
          (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
        FROM users u
        WHERE u.id != ?
-       ORDER BY u.created_at DESC`
-  ).all(ANON_USER_ID);
-  const pendingStewards = db.prepare(
+       ORDER BY u.created_at DESC`,
+    [ANON_USER_ID]
+  );
+  const pendingStewards = await db.all(
     `SELECT DISTINCT s.user_email AS email
          FROM stewards s
         WHERE s.is_active = 1
@@ -952,7 +1022,7 @@ authRoutes.get("/teammates", async (c) => {
                )
           )
         ORDER BY s.user_email`
-  ).all();
+  );
   const enriched = teammates.map((t) => ({ ...t, is_admin: isLicenseAdminEmail(t.email) })).sort((a, b) => Number(b.is_admin) - Number(a.is_admin));
   return c.json({
     teammates: enriched,
@@ -970,52 +1040,70 @@ import { serializeDocument, parseDocument as parseDocument2 } from "@promptowl/c
 function normalizeTag(raw) {
   return raw.trim().replace(/^#+/, "").toLowerCase();
 }
-function syncNodeTags(nestId, nodeId, tags) {
+async function syncNodeTags(nestId, nodeId, tags) {
   const db = getDb();
   const normalized = Array.from(
     new Set(
       tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
     )
   );
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    const insert = db.prepare(
-      "INSERT OR IGNORE INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+  const insertSql = insertOrIgnore(
+    db,
+    "INSERT INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+  );
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
     );
     for (const tag of normalized) {
-      insert.run(nestId, nodeId, tag);
+      await tx.run(insertSql, [nestId, nodeId, tag]);
     }
-  })();
+  });
 }
-function removeNodeFromTagIndex(nestId, nodeId) {
+async function removeNodeFromTagIndex(nestId, nodeId) {
   const db = getDb();
-  db.prepare(
-    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-  ).run(nestId, nodeId);
+  await db.run(
+    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
+    [nestId, nodeId]
+  );
 }
 
 // src/governance/access-guard.ts
-function resolveCallerEmail(userId) {
+async function resolveCallerEmail(userId) {
   if (!userId) return "admin@localhost";
   const db = getDb();
-  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const row = await db.get(
+    "SELECT email FROM users WHERE id = ?",
+    [userId]
+  );
   return row?.email || "admin@localhost";
 }
-function canReadNode(nestId, nodeId, userId, userEmail) {
-  if (isPublicReader(nestId, userId)) {
-    return getApprovedVersion(nestId, nodeId) !== null;
+async function canReadNode(nestId, nodeId, userId, userEmail) {
+  if (await isPublicReader(nestId, userId)) {
+    return await getApprovedVersion(nestId, nodeId) !== null;
   }
-  if (!isStewardshipEnabled(nestId)) return true;
-  return canUserAccess(nestId, nodeId, userEmail).allowed;
+  if (!await isStewardshipEnabled(nestId)) return true;
+  return (await canUserAccess(nestId, nodeId, userEmail)).allowed;
 }
-function filterAccessible(nestId, userId, userEmail, nodes) {
-  if (isPublicReader(nestId, userId)) {
-    return nodes.filter((n) => getApprovedVersion(nestId, n.id) !== null);
+async function filterAccessible(nestId, userId, userEmail, nodes) {
+  if (await isPublicReader(nestId, userId)) {
+    const filtered = [];
+    for (const n of nodes) {
+      if (await getApprovedVersion(nestId, n.id) !== null) {
+        filtered.push(n);
+      }
+    }
+    return filtered;
   }
-  if (!isStewardshipEnabled(nestId)) return nodes;
-  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
+  if (!await isStewardshipEnabled(nestId)) return nodes;
+  const accessible = [];
+  for (const n of nodes) {
+    if ((await canUserAccess(nestId, n.id, userEmail)).allowed) {
+      accessible.push(n);
+    }
+  }
+  return accessible;
 }
 
 // src/governance/external-edit-service.ts
@@ -1039,7 +1127,7 @@ var communityRbac = {
   isDocOwner: () => true
 };
 function docPath(nestId, documentId) {
-  return join(config.DATA_ROOT, "nests", nestId, `${documentId}.md`);
+  return join(resolveNestPath(nestId), `${documentId}.md`);
 }
 async function readRaw(nestId, documentId) {
   try {
@@ -1063,7 +1151,7 @@ async function loadChainHead(storage, documentId) {
   }
 }
 async function loadLatestApprovedNode(nestId, documentId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const head = await loadChainHead(storage, documentId);
   if (!head) return null;
   return parseDocument(docPath(nestId, documentId), head.content, documentId);
@@ -1079,7 +1167,7 @@ async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner"
   return res?.meta ?? null;
 }
 async function scanDocumentForDriftInternal(nestId, documentId, actor) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const node = await storage.readDocument(documentId).catch(() => null);
   if (!node) return null;
   const raw = await readRaw(nestId, documentId);
@@ -1106,7 +1194,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   return { meta: result.meta, created: true };
 }
 async function scanNestForDrift(nestId, actor = "system:scanner") {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const docs = await storage.discoverDocuments();
   const results = await Promise.all(
     docs.map((doc) => scanDocumentForDriftInternal(nestId, doc.id, actor))
@@ -1115,7 +1203,7 @@ async function scanNestForDrift(nestId, actor = "system:scanner") {
   return { scanned: docs.length, staged };
 }
 async function getPendingChange(nestId, documentId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const list = await listSuggestions(storage, documentId);
   for (let i = list.length - 1; i >= 0; i--) {
     const meta = list[i];
@@ -1132,7 +1220,7 @@ async function getPendingChange(nestId, documentId) {
   return null;
 }
 async function listNestExternalEdits(nestId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const docs = await storage.discoverDocuments();
   const lists = await Promise.all(
     docs.map(async (doc) => {
@@ -1161,7 +1249,7 @@ async function listNestExternalEdits(nestId) {
   return entries.sort((a, b) => b.detected_at.localeCompare(a.detected_at));
 }
 async function getExternalEditDetail(nestId, documentId, suggestionId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const found = await readSuggestion(storage, documentId, suggestionId);
   if (!found) return null;
   return {
@@ -1178,7 +1266,7 @@ async function getExternalEditDetail(nestId, documentId, suggestionId) {
   };
 }
 async function approveExternalEdit(input) {
-  const { storage } = engineCache.get(input.nestId);
+  const { storage } = await engineCache.get(input.nestId);
   let result;
   try {
     result = await approveSuggestion({
@@ -1201,8 +1289,8 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
-    createVersion2({
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-FJWVTZKR.js");
+    await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
       version: versionNum,
@@ -1212,7 +1300,12 @@ async function approveExternalEdit(input) {
       tags,
       changeNote: input.comment || "External edit approved"
     });
-    setApprovedVersion2(input.nestId, input.documentId, versionNum, input.actor);
+    await setApprovedVersion2(
+      input.nestId,
+      input.documentId,
+      versionNum,
+      input.actor
+    );
   } catch (err) {
     console.error(
       `[external-edit] failed to mirror approved version into node_versions for ${input.nestId}/${input.documentId}:`,
@@ -1222,7 +1315,7 @@ async function approveExternalEdit(input) {
   return result;
 }
 async function rejectExternalEdit(input) {
-  const { storage } = engineCache.get(input.nestId);
+  const { storage } = await engineCache.get(input.nestId);
   const result = await rejectSuggestion({
     storage,
     rbac: communityRbac,
@@ -1248,7 +1341,7 @@ async function rejectExternalEdit(input) {
 var scannerTimer = null;
 async function scanAllNests() {
   const db = getDb();
-  const rows = db.prepare("SELECT id FROM nests").all();
+  const rows = await db.all("SELECT id FROM nests");
   await Promise.all(
     rows.map(
       ({ id }) => scanNestForDrift(id).catch(
@@ -1268,9 +1361,9 @@ function startDriftScanner(intervalMs = 3e4) {
 }
 
 // src/nodes/service.ts
-function userIdFromEmail(email) {
+async function userIdFromEmail(email) {
   const db = getDb();
-  const row = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(email);
+  const row = await db.get("SELECT id FROM users WHERE LOWER(email) = LOWER(?)", [email]);
   return row?.id ?? ANON_USER_ID;
 }
 var normalizeTag2 = (t) => t.startsWith("#") ? t : `#${t}`;
@@ -1302,7 +1395,7 @@ function toNodeResponse(node) {
   };
 }
 async function listNodesForCaller(nestId, userId, filters = {}) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
   let documents = await storage.discoverDocuments();
   if (filters.type) {
     documents = documents.filter((n) => n.frontmatter.type === filters.type);
@@ -1313,14 +1406,14 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
       (n) => (n.frontmatter.tags || []).includes(tag)
     );
   }
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, documents);
-  const publicReader = isPublicReader(nestId, userId);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, documents);
+  const publicReader = await isPublicReader(nestId, userId);
   const enriched = await Promise.all(
     accessible.map(async (doc) => {
       const r = toNodeResponse(doc);
       if (publicReader) {
-        const approved = getApprovedVersion(nestId, doc.id);
+        const approved = await getApprovedVersion(nestId, doc.id);
         if (approved != null) {
           try {
             const raw = await versionManager.reconstructVersion(doc.id, approved);
@@ -1344,7 +1437,7 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         r.pendingChange = pending;
         r.status = "external_edit_pending";
       } else {
-        r.status = getDisplayStatus(nestId, r.id);
+        r.status = await getDisplayStatus(nestId, r.id);
       }
       return r;
     })
@@ -1352,15 +1445,26 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
   return filters.limit ? enriched.slice(0, filters.limit) : enriched;
 }
 async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
-  return listNodesForCaller(nestId, userIdFromEmail(userEmail), filters);
+  return listNodesForCaller(nestId, await userIdFromEmail(userEmail), filters);
 }
 async function createNode(nestId, input, userEmail) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
-  const slug = input.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-  const id = input.id ?? `nodes/${slug}`;
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const slug = slugify(input.title);
+  let id = input.id;
+  if (!id) {
+    const folderSegments = (input.folder ?? "").split("/").map(slugify).filter(Boolean);
+    if (folderSegments.length > 8) {
+      throw new ValidationError("folder may nest at most 8 levels deep");
+    }
+    if ([...folderSegments, slug].some((seg) => seg.length > 100)) {
+      throw new ValidationError("each folder or title segment must be at most 100 characters");
+    }
+    id = folderSegments.length > 0 ? `nodes/${folderSegments.join("/")}/${slug}` : `nodes/${slug}`;
+  }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tags = (input.tags || []).map(normalizeTag2);
-  const hasStewards = isStewardshipEnabled(nestId);
+  const hasStewards = await isStewardshipEnabled(nestId);
   const initialStatus = hasStewards ? "draft" : "published";
   const initialVersion = hasStewards ? 1 : 0;
   let node = {
@@ -1380,7 +1484,7 @@ async function createNode(nestId, input, userEmail) {
     rawContent: ""
   };
   await storage.writeDocument(id, serializeDocument(node));
-  syncNodeTags(nestId, id, tags);
+  await syncNodeTags(nestId, id, tags);
   let savedVersion = 1;
   if (hasStewards) {
     try {
@@ -1388,7 +1492,7 @@ async function createNode(nestId, input, userEmail) {
     } catch (err) {
       console.error("VersionManager.createVersion failed (node create)", err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId: id,
       version: 1,
@@ -1404,7 +1508,7 @@ async function createNode(nestId, input, userEmail) {
         note: "Auto-published on create (no stewards configured)"
       });
       savedVersion = result.node.frontmatter.version || 1;
-      createVersion({
+      await createVersion({
         nestId,
         nodeId: id,
         version: savedVersion,
@@ -1413,11 +1517,11 @@ async function createNode(nestId, input, userEmail) {
         status: "published",
         tags
       });
-      setApprovedVersion(nestId, id, savedVersion, userEmail);
+      await setApprovedVersion(nestId, id, savedVersion, userEmail);
       node = result.node;
     } catch (err) {
       console.error("publishDocument failed (node create auto-publish)", err);
-      createVersion({
+      await createVersion({
         nestId,
         nodeId: id,
         version: 1,
@@ -1428,11 +1532,11 @@ async function createNode(nestId, input, userEmail) {
       });
     }
   }
-  trackEvent("node.create", { nestId, nodeId: id });
+  await trackEvent("node.create", { nestId, nodeId: id });
   return { node, version: savedVersion };
 }
 async function registerImportedDocuments(nestId, userEmail) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   let docs;
   try {
     docs = await storage.discoverDocuments();
@@ -1443,7 +1547,7 @@ async function registerImportedDocuments(nestId, userEmail) {
   let registered = 0;
   for (const doc of docs) {
     const nodeId = doc.id;
-    if (getCurrentVersion(nestId, nodeId) > 0) continue;
+    if (await getCurrentVersion(nestId, nodeId) > 0) continue;
     const rawTags = Array.isArray(doc.frontmatter?.tags) ? doc.frontmatter.tags : [];
     const tags = rawTags.map((t) => normalizeTag2(String(t)));
     const fmVersion = Number(doc.frontmatter?.version);
@@ -1459,7 +1563,7 @@ async function registerImportedDocuments(nestId, userEmail) {
     } catch (err) {
       console.error("safePublishDocument failed (import register)", nodeId, err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId,
       version,
@@ -1469,15 +1573,15 @@ async function registerImportedDocuments(nestId, userEmail) {
       changeNote: "Imported from existing folder",
       tags
     });
-    setApprovedVersion(nestId, nodeId, version, userEmail);
-    syncNodeTags(nestId, nodeId, tags);
+    await setApprovedVersion(nestId, nodeId, version, userEmail);
+    await syncNodeTags(nestId, nodeId, tags);
     registered++;
   }
-  trackEvent("nest.import.documents", { nestId, registered });
+  await trackEvent("nest.import.documents", { nestId, registered });
   return registered;
 }
 async function updateNode(nestId, nodeId, patch, userEmail) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
   let node;
   try {
     node = await storage.readDocument(nodeId);
@@ -1501,16 +1605,16 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   if (patch.title) {
     node = { ...node, frontmatter: { ...node.frontmatter, title: patch.title } };
   }
-  const hasStewards = isStewardshipEnabled(nestId);
+  const hasStewards = await isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
-  if (hasStewards && getPendingReview(nestId, nodeId)) {
+  if (hasStewards && await getPendingReview(nestId, nodeId)) {
     throw new LockedError(
       "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
     );
   }
   let responseVersion;
   if (hasStewards) {
-    const currentVersion = getCurrentVersion(nestId, nodeId);
+    const currentVersion = await getCurrentVersion(nestId, nodeId);
     const newVersion = currentVersion + 1;
     node = {
       ...node,
@@ -1525,13 +1629,13 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
     };
     node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
     await storage.writeDocument(nodeId, serializeDocument(node));
-    syncNodeTags(nestId, nodeId, currentTags);
+    await syncNodeTags(nestId, nodeId, currentTags);
     try {
       await versionManager.createVersion(node, userEmail, { note: patch.changeNote });
     } catch (err) {
       console.error("VersionManager.createVersion failed (node patch)", err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId,
       version: newVersion,
@@ -1553,7 +1657,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
     };
     node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
     await storage.writeDocument(nodeId, serializeDocument(node));
-    syncNodeTags(nestId, nodeId, currentTags);
+    await syncNodeTags(nestId, nodeId, currentTags);
     let publishedVersion = (node.frontmatter.version || 0) + 1;
     try {
       const result = await safePublishDocument(storage, nodeId, {
@@ -1565,7 +1669,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
     } catch (err) {
       console.error("publishDocument failed (node patch auto-publish)", err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId,
       version: publishedVersion,
@@ -1575,7 +1679,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
       tags: currentTags,
       changeNote: patch.changeNote
     });
-    setApprovedVersion(nestId, nodeId, publishedVersion, userEmail);
+    await setApprovedVersion(nestId, nodeId, publishedVersion, userEmail);
     responseVersion = publishedVersion;
   }
   return { node, version: responseVersion };
@@ -1583,8 +1687,11 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
 
 // src/nests/unsynced-service.ts
 import { readdirSync, readFileSync, rmSync, statSync } from "fs";
-import { join as join2, relative } from "path";
+import { join as join2, relative, resolve } from "path";
 var RESERVED = /* @__PURE__ */ new Set(["nests"]);
+function isNestStorageRoot(absPath) {
+  return resolve(absPath) === resolve(nestStorageRoot());
+}
 function scanMarkdown(dir) {
   let count = 0;
   let size = 0;
@@ -1664,7 +1771,9 @@ function listUnsyncedFolders() {
     if (!e.isDirectory()) continue;
     if (e.name.startsWith(".")) continue;
     if (RESERVED.has(e.name)) continue;
-    out.push(...collectLeafFolders(e.name, join2(root, e.name)));
+    const abs = join2(root, e.name);
+    if (isNestStorageRoot(abs)) continue;
+    out.push(...collectLeafFolders(e.name, abs));
   }
   out.sort((a, b) => a.name.localeCompare(b.name));
   console.log(
@@ -1718,6 +1827,9 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   );
   assertSafeFolderName(folderName);
   const src = join2(config.DATA_ROOT, folderName);
+  if (isNestStorageRoot(src)) {
+    throw new ValidationError("Folder is not eligible for sync");
+  }
   let stat;
   try {
     stat = statSync(src);
@@ -1737,7 +1849,7 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   }
   const segments = folderName.split("/").filter(Boolean);
   const baseName = segments[segments.length - 1] || folderName;
-  const nestName = uniqueNestName(userId, baseName);
+  const nestName = await uniqueNestName(userId, baseName);
   if (nestName !== baseName) {
     console.log(
       `[unsynced] name "${baseName}" already in use, using "${nestName}" instead`
@@ -1761,10 +1873,13 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
 }
 
 // src/nests/routes.ts
-function effectivePermission(nestId, userId) {
+async function effectivePermission(nestId, userId) {
   if (config.AUTH_MODE === "open") {
     const db = getDb();
-    const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+    const nest = await db.get(
+      "SELECT user_id FROM nests WHERE id = ?",
+      [nestId]
+    );
     if (nest && nest.user_id === ANON_USER_ID) return "owner";
   }
   return resolveNestPermission(nestId, userId);
@@ -1772,21 +1887,30 @@ function effectivePermission(nestId, userId) {
 var nestRoutes = new Hono2();
 nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
-  const owned = listNests(userId);
-  const shared = listSharedNests(userId);
-  const publicExtras = listPublicNests(userId);
+  const owned = await listNests(userId);
+  const shared = await listSharedNests(userId);
+  const publicExtras = await listPublicNests(userId);
   const db = getDb();
-  const ownerEmailStmt = db.prepare(
-    "SELECT email FROM users WHERE id = ?"
-  );
-  const callerEmail = resolveCallerEmail(userId);
-  const annotate = (n) => {
-    const permission = effectivePermission(n.id, userId);
+  const ownerEmailSql = "SELECT email FROM users WHERE id = ?";
+  const callerEmail = await resolveCallerEmail(userId);
+  const annotate = async (n) => {
+    const permission = await effectivePermission(n.id, userId);
     const is_owner = permission === "owner";
     let owner_email = null;
-    const roles = is_owner ? ["owner"] : resolveUserRoles(n.id, callerEmail);
+    let roles;
+    if (is_owner) {
+      roles = ["owner"];
+    } else {
+      const grantRole = collabPermToRole(
+        await getCollaboratorRole(n.id, callerEmail)
+      );
+      const stewardRoles = await getStewardRolesForUser(n.id, callerEmail);
+      roles = [
+        ...new Set([grantRole, ...stewardRoles].filter(Boolean))
+      ];
+    }
     if (!is_owner && n.user_id !== ANON_USER_ID) {
-      const row = ownerEmailStmt.get(n.user_id);
+      const row = await db.get(ownerEmailSql, [n.user_id]);
       owner_email = row?.email ?? null;
     }
     return { ...n, permission, is_owner, owner_email, roles };
@@ -1796,9 +1920,27 @@ nestRoutes.get("/", async (c) => {
   for (const n of [...owned, ...shared, ...publicExtras]) {
     if (seen.has(n.id)) continue;
     seen.add(n.id);
-    out.push(annotate(n));
+    out.push(await annotate(n));
   }
-  return c.json({ nests: out });
+  const docRows = await db.all(
+    "SELECT nest_id, COUNT(DISTINCT node_id) AS c FROM node_versions GROUP BY nest_id"
+  );
+  const docByNest = new Map(docRows.map((r) => [r.nest_id, r.c]));
+  const collabRows = await db.all(
+    "SELECT nest_id, COUNT(*) AS c FROM nest_collaborators GROUP BY nest_id"
+  );
+  const collabByNest = new Map(collabRows.map((r) => [r.nest_id, r.c]));
+  const stewardRows = await db.all(
+    "SELECT nest_id, COUNT(DISTINCT user_email) AS c FROM stewards WHERE is_active = 1 GROUP BY nest_id"
+  );
+  const stewardByNest = new Map(stewardRows.map((r) => [r.nest_id, r.c]));
+  const withMeta = out.map((n) => ({
+    ...n,
+    document_count: docByNest.get(n.id) ?? 0,
+    collaborator_count: collabByNest.get(n.id) ?? 0,
+    steward_count: stewardByNest.get(n.id) ?? 0
+  }));
+  return c.json({ nests: withMeta });
 });
 nestRoutes.post("/", async (c) => {
   const body = await c.req.json();
@@ -1818,20 +1960,20 @@ nestRoutes.post("/import", async (c) => {
   const nest = await importNest(userId, body.name, files);
   const documents = await registerImportedDocuments(
     nest.id,
-    resolveCallerEmail(userId)
+    await resolveCallerEmail(userId)
   );
   return c.json({ nest, documents }, 201);
 });
 nestRoutes.get("/unsynced", async (c) => {
   const userId = c.get("userId");
-  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+  if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can list unsynced folders");
   }
   return c.json({ folders: listUnsyncedFolders() });
 });
 nestRoutes.post("/unsynced/sync", async (c) => {
   const userId = c.get("userId");
-  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+  if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can sync folders");
   }
   const body = await c.req.json();
@@ -1841,30 +1983,30 @@ nestRoutes.post("/unsynced/sync", async (c) => {
   const result = await syncUnsyncedFolder(
     userId,
     body.name,
-    resolveCallerEmail(userId)
+    await resolveCallerEmail(userId)
   );
   return c.json(result, 201);
 });
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const permission = effectivePermission(nestId, userId);
+  const permission = await effectivePermission(nestId, userId);
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
-  const email = resolveCallerEmail(userId);
-  let roles = resolveUserRoles(nestId, email);
+  const email = await resolveCallerEmail(userId);
+  let roles = await resolveUserRoles(nestId, email);
   if (permission === "owner" && !roles.includes("owner")) {
     roles = ["owner", ...roles];
   }
-  const myStewards = getStewardsForUser(nestId, email);
-  const nest = getNest(nestId);
+  const myStewards = await getStewardsForUser(nestId, email);
+  const nest = await getNest(nestId);
   return c.json({ nest, permission, roles, myStewards });
 });
 nestRoutes.patch("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const permission = effectivePermission(nestId, userId);
+  const permission = await effectivePermission(nestId, userId);
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
@@ -1874,7 +2016,7 @@ nestRoutes.patch("/:nestId", async (c) => {
     );
   }
   const body = await c.req.json();
-  const nest = renameNest(nestId, {
+  const nest = await renameNest(nestId, {
     name: body.name,
     description: body.description
   });
@@ -1883,13 +2025,13 @@ nestRoutes.patch("/:nestId", async (c) => {
 nestRoutes.delete("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const nest = getNest(nestId);
+  const nest = await getNest(nestId);
   if (!nest) {
     throw new NotFoundError("Nest not found");
   }
-  const permission = effectivePermission(nestId, userId);
+  const permission = await effectivePermission(nestId, userId);
   const isAnonOwned = nest.user_id === ANON_USER_ID;
-  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && isLicenseAdminUserId(userId);
+  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && await isLicenseAdminUserId(userId);
   if (permission !== "owner" && !adminCaretaker) {
     throw new ForbiddenError(
       "You don't have permission to delete this nest. Only the nest owner can delete it."
@@ -1900,24 +2042,24 @@ nestRoutes.delete("/:nestId", async (c) => {
 });
 nestRoutes.get("/:nestId/settings", async (c) => {
   const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
+  const permission = await effectivePermission(nestId, c.get("userId"));
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
   return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId),
-    allow_self_approve: nestAllowsSelfApprove(nestId)
+    stewardship_enabled: await isStewardshipEnabled(nestId),
+    allow_self_approve: await nestAllowsSelfApprove(nestId)
   });
 });
 nestRoutes.patch("/:nestId/settings", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const isServerAdmin = isLicenseAdminUserId(userId);
-  const permission = effectivePermission(nestId, userId);
-  if (!isServerAdmin && permission !== "owner") {
+  const isServerAdmin = await isLicenseAdminUserId(userId);
+  const permission = await effectivePermission(nestId, userId);
+  if (!isServerAdmin && permission !== "owner" && permission !== "admin") {
     return c.json(
       {
-        error: "Only the nest owner or the server license-admin can update nest settings."
+        error: "Only a nest admin, the nest owner, or the server license-admin can update nest settings."
       },
       403
     );
@@ -1926,17 +2068,25 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
   let wiped = null;
   if (typeof body.stewardship_enabled === "boolean") {
     if (body.stewardship_enabled) {
-      setStewardshipEnabled(nestId, true);
+      await setStewardshipEnabled(nestId, true);
     } else {
-      wiped = disableStewardshipAndWipeGovernance(nestId);
+      if (!isServerAdmin && permission !== "owner") {
+        return c.json(
+          {
+            error: "Only the nest owner or the server license-admin can disable stewardship (this permanently wipes stewards and pending reviews)."
+          },
+          403
+        );
+      }
+      wiped = await disableStewardshipAndWipeGovernance(nestId);
     }
   }
   if (typeof body.allow_self_approve === "boolean") {
-    setAllowSelfApprove(nestId, body.allow_self_approve);
+    await setAllowSelfApprove(nestId, body.allow_self_approve);
   }
   return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId),
-    allow_self_approve: nestAllowsSelfApprove(nestId),
+    stewardship_enabled: await isStewardshipEnabled(nestId),
+    allow_self_approve: await nestAllowsSelfApprove(nestId),
     wiped
   });
 });
@@ -1961,21 +2111,28 @@ async function addCollaborator(params) {
   let userId = params.userId;
   if (!userId && params.email) {
     const email = normalizeEmail(params.email);
-    const existing = db.prepare("SELECT id FROM users WHERE LOWER(email) = ?").get(email);
+    const existing = await db.get(
+      "SELECT id FROM users WHERE LOWER(email) = ?",
+      [email]
+    );
     if (existing) {
       userId = existing.id;
     } else {
       const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
       userId = uuid2();
-      db.prepare(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-      ).run(userId, email, null, await hashPassword2(uuid2()));
+      await db.run(
+        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+        [userId, email, null, await hashPassword2(uuid2())]
+      );
     }
   }
   if (!userId) {
     throw new ValidationError("user_id or email is required");
   }
-  const ownerRow = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+  const ownerRow = await db.get(
+    "SELECT user_id FROM nests WHERE id = ?",
+    [nestId]
+  );
   if (!ownerRow) {
     throw new ValidationError("Nest not found");
   }
@@ -1989,19 +2146,29 @@ async function addCollaborator(params) {
   if (selfByEmail || selfById) {
     throw new ValidationError("You can't add yourself as a collaborator.");
   }
-  const dupe = db.prepare("SELECT id FROM nest_collaborators WHERE nest_id = ? AND user_id = ?").get(nestId, userId);
+  const dupe = await db.get(
+    "SELECT id FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
   if (dupe) {
     throw new ConflictError(
       `${params.email || "This user"} already has access to this nest. Change their permission instead of adding them again.`
     );
   }
-  const granterByEmail = !params.grantedByUserId && params.grantedByEmail ? db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(params.grantedByEmail)?.id : void 0;
+  const granterByEmail = !params.grantedByUserId && params.grantedByEmail ? (await db.get(
+    "SELECT id FROM users WHERE LOWER(email) = LOWER(?)",
+    [params.grantedByEmail]
+  ))?.id : void 0;
   const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
   const collabId = uuid2();
-  db.prepare(
-    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)"
-  ).run(collabId, nestId, userId, params.permission, granterId);
-  return db.prepare("SELECT * FROM nest_collaborators WHERE id = ?").get(collabId);
+  await db.run(
+    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)",
+    [collabId, nestId, userId, params.permission, granterId]
+  );
+  return await db.get(
+    "SELECT * FROM nest_collaborators WHERE id = ?",
+    [collabId]
+  );
 }
 
 // src/nests/sharing-routes.ts
@@ -2009,20 +2176,25 @@ var sharingRoutes = new Hono3();
 sharingRoutes.get("/collaborators", async (c) => {
   const db = getDb();
   const nestId = c.req.param("nestId");
-  const collabs = db.prepare(
+  const collabs = await db.all(
     `SELECT nc.*, u.email FROM nest_collaborators nc
        LEFT JOIN users u ON nc.user_id = u.id
        WHERE nc.nest_id = ?
-       ORDER BY nc.granted_at`
-  ).all(nestId);
-  const enriched = collabs.map((collab) => {
-    if (!collab.email) return { ...collab, stewardRoles: [], roles: [] };
-    return {
+       ORDER BY nc.granted_at`,
+    [nestId]
+  );
+  const enriched = [];
+  for (const collab of collabs) {
+    if (!collab.email) {
+      enriched.push({ ...collab, stewardRoles: [], roles: [] });
+      continue;
+    }
+    enriched.push({
       ...collab,
-      stewardRoles: getStewardRolesForUser(nestId, collab.email),
-      roles: resolveUserRoles(nestId, collab.email)
-    };
-  });
+      stewardRoles: await getStewardRolesForUser(nestId, collab.email),
+      roles: await resolveUserRoles(nestId, collab.email)
+    });
+  }
   return c.json({ collaborators: enriched });
 });
 sharingRoutes.post("/collaborators", async (c) => {
@@ -2045,9 +2217,10 @@ sharingRoutes.patch("/collaborators/:collabId", async (c) => {
     throw new ValidationError("permission must be read, write, or admin");
   }
   const db = getDb();
-  const info = db.prepare(
-    "UPDATE nest_collaborators SET permission = ? WHERE id = ? AND nest_id = ?"
-  ).run(body.permission, c.req.param("collabId"), c.req.param("nestId"));
+  const info = await db.run(
+    "UPDATE nest_collaborators SET permission = ? WHERE id = ? AND nest_id = ?",
+    [body.permission, c.req.param("collabId"), c.req.param("nestId")]
+  );
   if (info.changes === 0) {
     throw new NotFoundError("Collaborator not found");
   }
@@ -2055,9 +2228,10 @@ sharingRoutes.patch("/collaborators/:collabId", async (c) => {
 });
 sharingRoutes.delete("/collaborators/:collabId", async (c) => {
   const db = getDb();
-  const info = db.prepare(
-    "DELETE FROM nest_collaborators WHERE id = ? AND nest_id = ?"
-  ).run(c.req.param("collabId"), c.req.param("nestId"));
+  const info = await db.run(
+    "DELETE FROM nest_collaborators WHERE id = ? AND nest_id = ?",
+    [c.req.param("collabId"), c.req.param("nestId")]
+  );
   if (info.changes === 0) {
     throw new NotFoundError("Collaborator not found");
   }
@@ -2069,10 +2243,10 @@ sharingRoutes.patch("/visibility", async (c) => {
     throw new ValidationError("visibility must be private or public");
   }
   const db = getDb();
-  db.prepare("UPDATE nests SET visibility = ? WHERE id = ?").run(
+  await db.run("UPDATE nests SET visibility = ? WHERE id = ?", [
     body.visibility,
     c.req.param("nestId")
-  );
+  ]);
   return c.json({ visibility: body.visibility });
 });
 
@@ -2099,372 +2273,74 @@ function isMarkdownFormat(c) {
   return c.req.query("format") === "markdown";
 }
 
-// src/nodes/routes.ts
-var nodeRoutes = new Hono4();
-function nodeAsMarkdown(response, nodeId) {
-  return nodeToMarkdown({
-    id: nodeId,
-    title: response.title,
-    tags: response.tags,
-    status: response.status,
-    body: response.content
-  });
+// src/annotations/service.ts
+import { v4 as uuid3 } from "uuid";
+
+// src/annotations/projection.ts
+var MAX_CONTEXT_CHARS = 250;
+var MAX_QUOTE_CHARS = 1e3;
+function clampAnchor(raw) {
+  if (!raw) return null;
+  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
+  if (!quote) return null;
+  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
+  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
+  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
+  return { quote, before, after, ...line !== void 0 ? { line } : {} };
 }
-nodeRoutes.get("/", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const nodes = await listNodesForCaller(nestId, userId);
-  return c.json({ count: nodes.length, nodes });
-});
-nodeRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.title || !body.content) {
-    throw new ValidationError("title and content are required");
+function oneLine(s) {
+  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
+}
+function renderAnchor(anchor) {
+  if (!anchor) {
+    return "<!-- anchor: whole-artifact -->";
   }
-  const nestId = c.req.param("nestId");
-  const authorEmail = getUserEmail(c);
-  const { node } = await createNode(
-    nestId,
-    {
-      title: body.title,
-      content: body.content,
-      type: body.type,
-      tags: body.tags,
-      scope: body.scope,
-      status: body.status
-    },
-    authorEmail
-  );
-  const resolved = resolveStewardsForNode(nestId, node.id);
-  return c.json({
-    node: toNodeResponse(node),
-    stewards: resolved.length > 0 ? resolved.map((r) => ({
-      email: r.steward.userEmail,
-      role: r.steward.role,
-      source: r.source
-    })) : void 0
-  }, 201);
-});
-nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-P4M5UEJW.js");
-  const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
-    nestId,
-    nodeId
-  );
-  return c.json({
-    nodeId,
-    stewards: stewards.map((r) => ({
-      email: r.steward.userEmail,
-      role: r.steward.role,
-      scope: r.steward.scope,
-      source: r.source,
-      priority: r.priority
-    })),
-    fallbackToOwner,
-    ownerEmail
+  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
+  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
+    anchor.after
+  )}\u2026`;
+  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
+}
+function statusHeading(thread) {
+  if (thread.status === "resolved") {
+    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
+    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
+    const meta = who || when ? ` (${who}${when})` : "";
+    return `\u2705 RESOLVED${meta}`;
+  }
+  return "\u{1F7E0} OPEN";
+}
+function snapshotLabel(v) {
+  return v == null ? "Unpinned" : `Snapshot v${v}`;
+}
+function orderThreads(threads) {
+  return [...threads].sort((a, b) => {
+    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
+    return a.createdAt.localeCompare(b.createdAt);
   });
-});
-nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
-  const allVersions = getVersions2(nestId, nodeId);
-  const approved = getApprovedVersion2(nestId, nodeId);
-  const db = getDb();
-  const resolutions = db.prepare(
-    `SELECT version, status, resolved_by, resolved_at
-         FROM review_requests
-        WHERE nest_id = ? AND node_id = ?
-          AND status IN ('approved', 'rejected')
-          AND resolved_by IS NOT NULL
-        ORDER BY resolved_at DESC`
-  ).all(nestId, nodeId);
-  const byVersion = /* @__PURE__ */ new Map();
-  for (const r of resolutions) {
-    if (!byVersion.has(r.version)) {
-      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
-    }
+}
+function projectThreadsToMarkdown(artifactTitle, threads) {
+  const lines = [];
+  lines.push(`# ${artifactTitle} \u2014 Annotations`);
+  lines.push("");
+  lines.push(
+    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
+  );
+  lines.push("");
+  if (threads.length === 0) {
+    lines.push("_No annotations yet._");
+    lines.push("");
+    return lines.join("\n");
   }
-  const enriched = allVersions.map((v) => {
-    const r = byVersion.get(v.version);
-    return r ? { ...v, resolvedBy: r.resolvedBy, resolutionStatus: r.status } : v;
-  });
-  return c.json({
-    versions: enriched,
-    approvedVersion: approved,
-    currentVersion: allVersions[0]?.version || 0
-  });
-});
-nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-XNXHF6Q7.js");
-  const history = getReviewHistory2(nestId, nodeId);
-  return c.json({ reviews: history });
-});
-nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { versions: versionManager } = engineCache.get(nestId);
-  const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
-    return c.json(
-      { error: "Access denied \u2014 no steward assignment for this node" },
-      403
-    );
-  }
-  const body = await c.req.json().catch(() => ({}));
-  const targetVersion = Number(body.targetVersion);
-  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
-    throw new ValidationError("targetVersion (a positive integer) is required");
-  }
-  let raw;
-  try {
-    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
-  } catch {
-    throw new NotFoundError(
-      `Version ${targetVersion} not found for ${nodeId}`
-    );
-  }
-  const content = bodyOnly(nodeId, raw);
-  const { node, version } = await updateNode(
-    nestId,
-    nodeId,
-    { content, changeNote: `Restored from version ${targetVersion}` },
-    userEmail
-  );
-  trackEvent("node.revert", { nestId, nodeId, targetVersion });
-  return c.json({ ok: true, version, node: toNodeResponse(node) });
-});
-nodeRoutes.get("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { storage, versions: versionManager } = engineCache.get(nestId);
-  const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
-    return c.json(
-      { error: "Access denied \u2014 no steward assignment for this node" },
-      403
-    );
-  }
-  let node;
-  try {
-    node = await storage.readDocument(nodeId, { verifyChecksum: true });
-  } catch {
-    throw new NotFoundError(`Node not found: ${nodeId}`);
-  }
-  if (node.pendingChange) {
-    try {
-      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
-      const refreshed = await getPendingChange(nestId, nodeId);
-      if (refreshed) node.pendingChange = refreshed;
-    } catch (err) {
-      console.error("[external-edit] stage-on-read failed:", err);
-    }
-    try {
-      const latest = await loadLatestApprovedNode(nestId, nodeId);
-      if (latest) {
-        node = { ...latest, pendingChange: node.pendingChange };
-      }
-    } catch (err) {
-      console.error("[external-edit] reconstruct-latest failed:", err);
-    }
-  }
-  const response = toNodeResponse(node);
-  if (isPublicReader(nestId, userId)) {
-    const approved = getApprovedVersion(nestId, nodeId);
-    if (approved != null) {
-      try {
-        const raw = await versionManager.reconstructVersion(
-          nodeId,
-          approved
-        );
-        response.content = bodyOnly(nodeId, raw);
-      } catch (err) {
-        console.error(
-          "reconstructVersion failed (public single)",
-          nodeId,
-          approved,
-          err
-        );
-        response.content = "";
-      }
-      response.version = approved;
-      response.status = "published";
-      if (isMarkdownFormat(c)) {
-        return c.body(nodeAsMarkdown(response, nodeId), 200, {
-          "Content-Type": "text/markdown; charset=utf-8"
-        });
-      }
-      return c.json({ node: response });
-    }
-  }
-  response.status = node.pendingChange ? "external_edit_pending" : getDisplayStatus(nestId, nodeId);
-  if (response.status === "pending_review") {
-    const pending = getPendingReview(nestId, nodeId);
-    response.pendingReviewBy = pending?.requestedBy ?? null;
-  }
-  if (isMarkdownFormat(c)) {
-    return c.body(nodeAsMarkdown(response, nodeId), 200, {
-      "Content-Type": "text/markdown; charset=utf-8"
-    });
-  }
-  return c.json({ node: response });
-});
-nodeRoutes.patch("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const body = await c.req.json();
-  const baseVersionHeader = c.req.header("X-Base-Version");
-  if (baseVersionHeader) {
-    const baseVersion = parseInt(baseVersionHeader, 10);
-    const conflict = checkConflict(nestId, nodeId, baseVersion);
-    if (conflict.conflict) {
-      return c.json(
-        {
-          error: "Version conflict",
-          your_version: baseVersion,
-          current_version: conflict.currentVersion,
-          updated_by: conflict.updatedBy,
-          updated_at: conflict.updatedAt,
-          rejected_content: body.content || body.append || null
-        },
-        409
-      );
-    }
-  }
-  const authorEmail = getUserEmail(c);
-  const { node, version: responseVersion } = await updateNode(
-    nestId,
-    nodeId,
-    {
-      content: body.content,
-      append: body.append,
-      tags: body.tags,
-      title: body.title,
-      status: body.status,
-      changeNote: body.changeNote
-    },
-    authorEmail
-  );
-  return c.json({ node: toNodeResponse(node), version: responseVersion });
-});
-nodeRoutes.delete("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { storage } = engineCache.get(nestId);
-  if (isStewardshipEnabled(nestId) && getPendingReview(nestId, nodeId)) {
-    throw new LockedError(
-      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
-    );
-  }
-  try {
-    await storage.deleteDocument(nodeId);
-  } catch {
-    throw new NotFoundError(`Node not found: ${nodeId}`);
-  }
-  removeNodeFromTagIndex(nestId, nodeId);
-  const db = getDb();
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    db.prepare(
-      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    db.prepare(
-      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    db.prepare(
-      `DELETE FROM stewards
-       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`
-    ).run(nestId, nodeId);
-  })();
-  trackEvent("node.delete", { nestId, nodeId });
-  return c.json({ deleted: true });
-});
-function getUserEmail(c) {
-  const userId = c.get("userId");
-  const db = getDb();
-  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
-  return user?.email || "anonymous@localhost";
-}
-
-// src/annotations/routes.ts
-import { Hono as Hono5 } from "hono";
-
-// src/annotations/service.ts
-import { v4 as uuid3 } from "uuid";
-
-// src/annotations/projection.ts
-var MAX_CONTEXT_CHARS = 250;
-var MAX_QUOTE_CHARS = 1e3;
-function clampAnchor(raw) {
-  if (!raw) return null;
-  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
-  if (!quote) return null;
-  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
-  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
-  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
-  return { quote, before, after, ...line !== void 0 ? { line } : {} };
-}
-function oneLine(s) {
-  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
-}
-function renderAnchor(anchor) {
-  if (!anchor) {
-    return "<!-- anchor: whole-artifact -->";
-  }
-  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
-  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
-    anchor.after
-  )}\u2026`;
-  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
-}
-function statusHeading(thread) {
-  if (thread.status === "resolved") {
-    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
-    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
-    const meta = who || when ? ` (${who}${when})` : "";
-    return `\u2705 RESOLVED${meta}`;
-  }
-  return "\u{1F7E0} OPEN";
-}
-function snapshotLabel(v) {
-  return v == null ? "Unpinned" : `Snapshot v${v}`;
-}
-function orderThreads(threads) {
-  return [...threads].sort((a, b) => {
-    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
-    return a.createdAt.localeCompare(b.createdAt);
-  });
-}
-function projectThreadsToMarkdown(artifactTitle, threads) {
-  const lines = [];
-  lines.push(`# ${artifactTitle} \u2014 Annotations`);
-  lines.push("");
-  lines.push(
-    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
-  );
-  lines.push("");
-  if (threads.length === 0) {
-    lines.push("_No annotations yet._");
-    lines.push("");
-    return lines.join("\n");
-  }
-  const buckets2 = /* @__PURE__ */ new Map();
-  for (const t of threads) {
-    const key = t.snapshotVersion ?? null;
-    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
-  }
-  const keys = [...buckets2.keys()].sort((a, b) => {
-    if (a == null) return 1;
-    if (b == null) return -1;
-    return b - a;
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const t of threads) {
+    const key = t.snapshotVersion ?? null;
+    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
+  }
+  const keys = [...buckets2.keys()].sort((a, b) => {
+    if (a == null) return 1;
+    if (b == null) return -1;
+    return b - a;
   });
   for (const key of keys) {
     lines.push(`## ${snapshotLabel(key)}`);
@@ -2484,11 +2360,12 @@ function projectThreadsToMarkdown(artifactTitle, threads) {
 }
 
 // src/annotations/service.ts
-function loadComments(threadId) {
+async function loadComments(threadId) {
   const db = getDb();
-  const rows = db.prepare(
-    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, rowid ASC"
-  ).all(threadId);
+  const rows = await db.all(
+    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, id ASC",
+    [threadId]
+  );
   return rows.map((r) => ({
     id: r.id,
     author: r.author,
@@ -2496,7 +2373,7 @@ function loadComments(threadId) {
     createdAt: r.created_at
   }));
 }
-function rowToThread(row) {
+async function rowToThread(row) {
   let anchor = null;
   if (row.anchor_json) {
     try {
@@ -2516,19 +2393,32 @@ function rowToThread(row) {
     createdAt: row.created_at,
     resolvedBy: row.resolved_by,
     resolvedAt: row.resolved_at,
-    comments: loadComments(row.id)
+    comments: await loadComments(row.id)
   };
 }
-function getThreadRow(threadId) {
-  return getDb().prepare("SELECT * FROM annotation_threads WHERE id = ?").get(threadId);
+async function getThreadRow(threadId) {
+  return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
+}
+async function countThreadsByNode(nestId) {
+  const rows = await getDb().all(
+    `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
+         FROM annotation_threads
+        WHERE nest_id = ?
+        GROUP BY node_id`,
+    [nestId]
+  );
+  const out = {};
+  for (const r of rows) out[r.node_id] = { count: r.count, lastAt: r.last_at };
+  return out;
 }
-function listThreads(nestId, nodeId) {
-  const rows = getDb().prepare(
-    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, rowid ASC"
-  ).all(nestId, nodeId);
-  return rows.map(rowToThread);
+async function listThreads(nestId, nodeId) {
+  const rows = await getDb().all(
+    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, id ASC",
+    [nestId, nodeId]
+  );
+  return Promise.all(rows.map(rowToThread));
 }
-function createThread(nestId, nodeId, input, authorEmail) {
+async function createThread(nestId, nodeId, input, authorEmail) {
   const body = (input.body ?? "").trim();
   if (!body) {
     throw new Error("comment body is required");
@@ -2536,61 +2426,66 @@ function createThread(nestId, nodeId, input, authorEmail) {
   const db = getDb();
   const id = uuid3();
   const anchor = clampAnchor(input.anchor);
-  const snapshot = input.snapshotVersion ?? getApprovedVersion(nestId, nodeId) ?? null;
-  const tx = db.transaction(() => {
-    db.prepare(
+  const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
+  await db.transaction(async (tx) => {
+    await tx.run(
       `INSERT INTO annotation_threads
          (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
-       VALUES (?, ?, ?, ?, ?, 'open', ?)`
-    ).run(
-      id,
-      nestId,
-      nodeId,
-      snapshot,
-      anchor ? JSON.stringify(anchor) : null,
-      authorEmail
+       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
+      [
+        id,
+        nestId,
+        nodeId,
+        snapshot,
+        anchor ? JSON.stringify(anchor) : null,
+        authorEmail
+      ]
+    );
+    await tx.run(
+      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+      [uuid3(), id, authorEmail, body]
     );
-    db.prepare(
-      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
-    ).run(uuid3(), id, authorEmail, body);
   });
-  tx();
-  return rowToThread(getThreadRow(id));
+  return rowToThread(await getThreadRow(id));
 }
-function getScopedThreadRow(threadId, nestId, nodeId) {
-  const row = getThreadRow(threadId);
+async function getScopedThreadRow(threadId, nestId, nodeId) {
+  const row = await getThreadRow(threadId);
   if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
     throw new NotFoundError(`Thread not found: ${threadId}`);
   }
   return row;
 }
-function addComment(nestId, nodeId, threadId, authorEmail, body) {
+async function addComment(nestId, nodeId, threadId, authorEmail, body) {
   const trimmed = (body ?? "").trim();
   if (!trimmed) {
     throw new Error("comment body is required");
   }
-  getScopedThreadRow(threadId, nestId, nodeId);
-  getDb().prepare(
-    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
-  ).run(uuid3(), threadId, authorEmail, trimmed);
-  return rowToThread(getThreadRow(threadId));
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  await getDb().run(
+    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+    [uuid3(), threadId, authorEmail, trimmed]
+  );
+  return rowToThread(await getThreadRow(threadId));
 }
-function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
-  getScopedThreadRow(threadId, nestId, nodeId);
+async function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  const db = getDb();
   if (status === "resolved") {
-    getDb().prepare(
-      "UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now') WHERE id = ?"
-    ).run(byEmail, threadId);
+    await db.run(
+      `UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)} WHERE id = ?`,
+      [byEmail, threadId]
+    );
   } else {
-    getDb().prepare(
-      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?"
-    ).run(threadId);
+    await db.run(
+      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?",
+      [threadId]
+    );
   }
-  return rowToThread(getThreadRow(threadId));
+  return rowToThread(await getThreadRow(threadId));
 }
 async function readArtifact(nestId, nodeId, version) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
-  const target = version ?? getApprovedVersion(nestId, nodeId) ?? null;
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const target = version ?? await getApprovedVersion(nestId, nodeId) ?? null;
   let title = nodeId;
   let type = null;
   let liveHtml = "";
@@ -2617,52 +2512,388 @@ async function readArtifact(nestId, nodeId, version) {
   if (!liveExists) {
     throw new NotFoundError(`Artifact not found: ${nodeId}`);
   }
-  return { title, html: liveHtml, version: target, type };
-}
-function derivedAnnotationsId(sourceNodeId) {
-  const base = sourceNodeId.replace(/^nodes\//, "");
-  return `nodes/${base}--annotations`;
-}
-async function syncAnnotationsNode(nestId, nodeId, userEmail) {
+  return { title, html: liveHtml, version: target, type };
+}
+function derivedAnnotationsId(sourceNodeId) {
+  const base = sourceNodeId.replace(/^nodes\//, "");
+  return `nodes/${base}--annotations`;
+}
+async function syncAnnotationsNode(nestId, nodeId, userEmail) {
+  try {
+    let title = nodeId;
+    let type = null;
+    try {
+      const { storage } = await engineCache.get(nestId);
+      const node = await storage.readDocument(nodeId);
+      title = node.frontmatter?.title || nodeId;
+      type = node.frontmatter?.type || "document";
+    } catch {
+    }
+    if (type !== null && type !== "artifact") return;
+    const threads = await listThreads(nestId, nodeId);
+    const derivedTitle = `${title} \u2014 Annotations`;
+    const markdown = projectThreadsToMarkdown(title, threads);
+    const derivedId = derivedAnnotationsId(nodeId);
+    try {
+      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
+    } catch (err) {
+      if (err instanceof NotFoundError) {
+        await createNode(
+          nestId,
+          {
+            id: derivedId,
+            title: derivedTitle,
+            content: markdown,
+            type: "document",
+            tags: ["annotations"]
+          },
+          userEmail
+        );
+      } else {
+        throw err;
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
+      err
+    );
+  }
+}
+
+// src/nodes/routes.ts
+var nodeRoutes = new Hono4();
+function nodeAsMarkdown(response, nodeId) {
+  return nodeToMarkdown({
+    id: nodeId,
+    title: response.title,
+    tags: response.tags,
+    status: response.status,
+    body: response.content
+  });
+}
+nodeRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const nodes = await listNodesForCaller(nestId, userId);
+  return c.json({ count: nodes.length, nodes });
+});
+nodeRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.title || !body.content) {
+    throw new ValidationError("title and content are required");
+  }
+  if (body.folder !== void 0 && typeof body.folder !== "string") {
+    throw new ValidationError('folder must be a string path like "gtm/deals"');
+  }
+  const nestId = c.req.param("nestId");
+  const authorEmail = await getUserEmail(c);
+  const { node } = await createNode(
+    nestId,
+    {
+      title: body.title,
+      content: body.content,
+      type: body.type,
+      tags: body.tags,
+      scope: body.scope,
+      status: body.status,
+      folder: body.folder
+    },
+    authorEmail
+  );
+  const resolved = await resolveStewardsForNode(nestId, node.id);
+  return c.json({
+    node: toNodeResponse(node),
+    stewards: resolved.length > 0 ? resolved.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      source: r.source
+    })) : void 0
+  }, 201);
+});
+nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-I2JAFYJU.js");
+  const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
+    nestId,
+    nodeId
+  );
+  return c.json({
+    nodeId,
+    stewards: stewards.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      scope: r.steward.scope,
+      source: r.source,
+      priority: r.priority
+    })),
+    fallbackToOwner,
+    ownerEmail
+  });
+});
+nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-FJWVTZKR.js");
+  const allVersions = await getVersions2(nestId, nodeId);
+  const approved = await getApprovedVersion2(nestId, nodeId);
+  const db = getDb();
+  const resolutions = await db.all(
+    `SELECT version, status, resolved_by, resolved_at
+         FROM review_requests
+        WHERE nest_id = ? AND node_id = ?
+          AND status IN ('approved', 'rejected')
+          AND resolved_by IS NOT NULL
+        ORDER BY resolved_at DESC`,
+    [nestId, nodeId]
+  );
+  const byVersion = /* @__PURE__ */ new Map();
+  for (const r of resolutions) {
+    if (!byVersion.has(r.version)) {
+      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
+    }
+  }
+  const enriched = allVersions.map((v) => {
+    const r = byVersion.get(v.version);
+    return r ? { ...v, resolvedBy: r.resolvedBy, resolutionStatus: r.status } : v;
+  });
+  return c.json({
+    versions: enriched,
+    approvedVersion: approved,
+    currentVersion: allVersions[0]?.version || 0
+  });
+});
+nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-2FSKW425.js");
+  const history = await getReviewHistory2(nestId, nodeId);
+  return c.json({ reviews: history });
+});
+nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { versions: versionManager } = await engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const body = await c.req.json().catch(() => ({}));
+  const targetVersion = Number(body.targetVersion);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw new ValidationError("targetVersion (a positive integer) is required");
+  }
+  let raw;
+  try {
+    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
+  } catch {
+    throw new NotFoundError(
+      `Version ${targetVersion} not found for ${nodeId}`
+    );
+  }
+  const content = bodyOnly(nodeId, raw);
+  const { node, version } = await updateNode(
+    nestId,
+    nodeId,
+    { content, changeNote: `Restored from version ${targetVersion}` },
+    userEmail
+  );
+  await trackEvent("node.revert", { nestId, nodeId, targetVersion });
+  return c.json({ ok: true, version, node: toNodeResponse(node) });
+});
+nodeRoutes.get("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  let node;
   try {
-    let title = nodeId;
+    node = await storage.readDocument(nodeId, { verifyChecksum: true });
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  if (node.pendingChange) {
     try {
-      const { storage } = engineCache.get(nestId);
-      const node = await storage.readDocument(nodeId);
-      title = node.frontmatter?.title || nodeId;
-    } catch {
+      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
+      const refreshed = await getPendingChange(nestId, nodeId);
+      if (refreshed) node.pendingChange = refreshed;
+    } catch (err) {
+      console.error("[external-edit] stage-on-read failed:", err);
     }
-    const threads = listThreads(nestId, nodeId);
-    const derivedTitle = `${title} \u2014 Annotations`;
-    const markdown = projectThreadsToMarkdown(title, threads);
-    const derivedId = derivedAnnotationsId(nodeId);
     try {
-      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
+      const latest = await loadLatestApprovedNode(nestId, nodeId);
+      if (latest) {
+        node = { ...latest, pendingChange: node.pendingChange };
+      }
     } catch (err) {
-      if (err instanceof NotFoundError) {
-        await createNode(
-          nestId,
-          {
-            id: derivedId,
-            title: derivedTitle,
-            content: markdown,
-            type: "document",
-            tags: ["annotations"]
-          },
-          userEmail
+      console.error("[external-edit] reconstruct-latest failed:", err);
+    }
+  }
+  const response = toNodeResponse(node);
+  if (await isPublicReader(nestId, userId)) {
+    const approved = await getApprovedVersion(nestId, nodeId);
+    if (approved != null) {
+      try {
+        const raw = await versionManager.reconstructVersion(
+          nodeId,
+          approved
         );
-      } else {
-        throw err;
+        response.content = bodyOnly(nodeId, raw);
+      } catch (err) {
+        console.error(
+          "reconstructVersion failed (public single)",
+          nodeId,
+          approved,
+          err
+        );
+        response.content = "";
       }
+      response.version = approved;
+      response.status = "published";
+      if (isMarkdownFormat(c)) {
+        return c.body(nodeAsMarkdown(response, nodeId), 200, {
+          "Content-Type": "text/markdown; charset=utf-8"
+        });
+      }
+      return c.json({ node: response });
     }
-  } catch (err) {
-    console.warn(
-      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
-      err
+  }
+  response.status = node.pendingChange ? "external_edit_pending" : await getDisplayStatus(nestId, nodeId);
+  if (response.status === "pending_review") {
+    const pending = await getPendingReview(nestId, nodeId);
+    response.pendingReviewBy = pending?.requestedBy ?? null;
+  }
+  if (isMarkdownFormat(c)) {
+    return c.body(nodeAsMarkdown(response, nodeId), 200, {
+      "Content-Type": "text/markdown; charset=utf-8"
+    });
+  }
+  return c.json({ node: response });
+});
+nodeRoutes.patch("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  const baseVersionHeader = c.req.header("X-Base-Version");
+  if (baseVersionHeader) {
+    const baseVersion = parseInt(baseVersionHeader, 10);
+    const conflict = await checkConflict(nestId, nodeId, baseVersion);
+    if (conflict.conflict) {
+      return c.json(
+        {
+          error: "Version conflict",
+          your_version: baseVersion,
+          current_version: conflict.currentVersion,
+          updated_by: conflict.updatedBy,
+          updated_at: conflict.updatedAt,
+          rejected_content: body.content || body.append || null
+        },
+        409
+      );
+    }
+  }
+  const authorEmail = await getUserEmail(c);
+  const { node, version: responseVersion } = await updateNode(
+    nestId,
+    nodeId,
+    {
+      content: body.content,
+      append: body.append,
+      tags: body.tags,
+      title: body.title,
+      status: body.status,
+      changeNote: body.changeNote
+    },
+    authorEmail
+  );
+  return c.json({ node: toNodeResponse(node), version: responseVersion });
+});
+nodeRoutes.delete("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage } = await engineCache.get(nestId);
+  if (await isStewardshipEnabled(nestId) && await getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
     );
   }
+  try {
+    await storage.deleteDocument(nodeId);
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  await removeNodeFromTagIndex(nestId, nodeId);
+  const derivedId = derivedAnnotationsId(nodeId);
+  try {
+    await storage.deleteDocument(derivedId);
+    await removeNodeFromTagIndex(nestId, derivedId);
+  } catch {
+  }
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      `DELETE FROM stewards
+       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM annotation_threads WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+    await tx.run(
+      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+    await tx.run(
+      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+    await tx.run(
+      "DELETE FROM annotation_threads WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+  });
+  await trackEvent("node.delete", { nestId, nodeId });
+  return c.json({ deleted: true });
+});
+async function getUserEmail(c) {
+  const userId = c.get("userId");
+  const db = getDb();
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
+  return user?.email || "anonymous@localhost";
 }
 
+// src/annotations/routes.ts
+import { Hono as Hono5 } from "hono";
+
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
@@ -2680,25 +2911,25 @@ annotationRoutes.get("/:nodeId{.+}/annotations", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = getNodeId(c);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
-  return c.json({ threads: listThreads(nestId, nodeId) });
+  return c.json({ threads: await listThreads(nestId, nodeId) });
 });
 annotationRoutes.post("/:nodeId{.+}/annotations", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = getNodeId(c);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
   const input = await c.req.json();
   if (!input.body || !input.body.trim()) {
     throw new ValidationError("body is required");
   }
-  const thread = createThread(
+  const thread = await createThread(
     nestId,
     nodeId,
     {
@@ -2716,15 +2947,15 @@ annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/comments", async (c) =
   const nodeId = getNodeId(c);
   const threadId = c.req.param("threadId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
   const input = await c.req.json();
   if (!input.body || !input.body.trim()) {
     throw new ValidationError("body is required");
   }
-  const thread = addComment(nestId, nodeId, threadId, userEmail, input.body);
+  const thread = await addComment(nestId, nodeId, threadId, userEmail, input.body);
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 });
@@ -2733,11 +2964,11 @@ annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/resolve", async (c) =>
   const nodeId = getNodeId(c);
   const threadId = c.req.param("threadId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
-  const thread = setThreadStatus(nestId, nodeId, threadId, "resolved", userEmail);
+  const thread = await setThreadStatus(nestId, nodeId, threadId, "resolved", userEmail);
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 });
@@ -2746,11 +2977,11 @@ annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/reopen", async (c) =>
   const nodeId = getNodeId(c);
   const threadId = c.req.param("threadId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
-  const thread = setThreadStatus(nestId, nodeId, threadId, "open", userEmail);
+  const thread = await setThreadStatus(nestId, nodeId, threadId, "open", userEmail);
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 });
@@ -2758,8 +2989,8 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = getNodeId(c);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
   const vRaw = c.req.query("v");
@@ -2950,15 +3181,16 @@ function tokenizePrompt(prompt) {
   const words = prompt.toLowerCase().split(/[^a-z0-9_-]+/).filter(Boolean).filter((w) => w.length >= 3 && !STOPWORDS.has(w));
   return Array.from(new Set(words));
 }
-function compilePrompt(prompt, nestId, titles) {
+async function compilePrompt(prompt, nestId, titles) {
   const tokens = tokenizePrompt(prompt);
   if (tokens.length === 0) {
     return { selector: null, matchedTags: [], matchedTitles: [], unmatched: [] };
   }
   const db = getDb();
-  const tagRows = db.prepare(
-    "SELECT DISTINCT tag_name FROM node_tag_index WHERE nest_id = ?"
-  ).all(nestId);
+  const tagRows = await db.all(
+    "SELECT DISTINCT tag_name FROM node_tag_index WHERE nest_id = ?",
+    [nestId]
+  );
   const knownTags = new Set(tagRows.map((r) => r.tag_name));
   const matchedTags = /* @__PURE__ */ new Set();
   for (const token of tokens) {
@@ -2988,11 +3220,11 @@ function compilePrompt(prompt, nestId, titles) {
 
 // src/nodes/readable-body.ts
 async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
-  if (!isPublicReader(nestId, userId)) return workingBody;
-  const approved = getApprovedVersion(nestId, nodeId);
+  if (!await isPublicReader(nestId, userId)) return workingBody;
+  const approved = await getApprovedVersion(nestId, nodeId);
   if (approved == null) return "";
   try {
-    const { versions } = engineCache.get(nestId);
+    const { versions } = await engineCache.get(nestId);
     const raw = await versions.reconstructVersion(nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
@@ -3000,11 +3232,11 @@ async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
   }
 }
 async function resolveExportBody(nestId, nodeId, workingBody) {
-  if (!isStewardshipEnabled(nestId)) return workingBody;
-  const approved = getApprovedVersion(nestId, nodeId);
+  if (!await isStewardshipEnabled(nestId)) return workingBody;
+  const approved = await getApprovedVersion(nestId, nodeId);
   if (approved == null) return null;
   try {
-    const { versions } = engineCache.get(nestId);
+    const { versions } = await engineCache.get(nestId);
     const raw = await versions.reconstructVersion(nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
@@ -3027,9 +3259,9 @@ function extractWikiTargets(body) {
   return out;
 }
 async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const docs = await storage.discoverDocuments();
-  const accessible = filterAccessible(nestId, userId, userEmail, docs);
+  const accessible = await filterAccessible(nestId, userId, userEmail, docs);
   const idSet = new Set(accessible.map((d) => d.id));
   const titleToId = /* @__PURE__ */ new Map();
   for (const d of accessible) {
@@ -3065,7 +3297,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
     }
   }
   const tags = [...tagCounts.entries()].map(([name, count]) => ({ name, count })).sort((a, b) => b.count - a.count);
-  const exposeStewards = isStewardshipEnabled(nestId) && !isPublicReader(nestId, userId);
+  const exposeStewards = await isStewardshipEnabled(nestId) && !await isPublicReader(nestId, userId);
   const stewardRows = exposeStewards ? (await listStewards({ nestId })).filter(
     // Drop document-scoped rows whose node the caller can't see.
     (s) => s.scope !== "document" || idSet.has(s.nodePattern || "")
@@ -3159,7 +3391,7 @@ var queryRoutes = new Hono6();
 queryRoutes.get("/graph", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
+  const userEmail = await resolveCallerEmail(userId);
   const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
   const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
   return c.json(graph);
@@ -3184,17 +3416,36 @@ queryRoutes.post("/context", async (c) => {
     throw new ValidationError("prompt or selector is required");
   }
   const nestId = c.req.param("nestId");
-  const { query: queryEngine, storage } = engineCache.get(nestId);
+  const { query: queryEngine, storage } = await engineCache.get(nestId);
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
   const hops = body.hops ?? 2;
   const includeDrafts = body.include_drafts === true;
+  const isVisible = (d) => includeDrafts || d.frontmatter.status === "published";
   let selector = body.selector?.trim() || null;
   let compileDetail = null;
   let titleMatches = [];
+  let resolvedTitleSelector = false;
   const allDocs = await storage.discoverDocuments();
-  if (!selector && body.prompt) {
+  if (selector && selector.includes("[[")) {
+    const parts = selector.split("|").map((p) => p.trim()).filter(Boolean);
+    const wantedTitles = /* @__PURE__ */ new Set();
+    const rest = [];
+    for (const p of parts) {
+      const m = /^\[\[(.+)\]\]$/.exec(p);
+      if (m) wantedTitles.add(m[1].trim().toLowerCase());
+      else rest.push(p);
+    }
+    if (wantedTitles.size > 0) {
+      selector = rest.join("|") || null;
+      resolvedTitleSelector = true;
+      titleMatches = allDocs.filter(
+        (d) => wantedTitles.has(String(d.frontmatter.title || "").toLowerCase()) && isVisible(d)
+      );
+    }
+  }
+  if (!selector && !resolvedTitleSelector && body.prompt) {
     const titles = allDocs.map((d) => d.frontmatter.title);
-    compileDetail = compilePrompt(body.prompt, nestId, titles);
+    compileDetail = await compilePrompt(body.prompt, nestId, titles);
     selector = compileDetail.selector;
     if (compileDetail.matchedTitles.length > 0) {
       const matchedLower = new Set(
@@ -3218,6 +3469,44 @@ queryRoutes.post("/context", async (c) => {
     hopsUsed = result.hopsUsed;
     nodesTraversed = result.nodesTraversed;
   }
+  if (titleMatches.length > 0 && hops > 0) {
+    const byTitle = new Map(
+      allDocs.map((d) => [
+        String(d.frontmatter.title || "").toLowerCase(),
+        d
+      ])
+    );
+    const byId = new Map(allDocs.map((d) => [d.id, d]));
+    const adj = /* @__PURE__ */ new Map();
+    const link = (a, b) => {
+      (adj.get(a) ?? adj.set(a, /* @__PURE__ */ new Set()).get(a)).add(b);
+      (adj.get(b) ?? adj.set(b, /* @__PURE__ */ new Set()).get(b)).add(a);
+    };
+    for (const d of allDocs) {
+      for (const target of extractWikiTargets(d.body || "")) {
+        const t = byId.get(target) ?? byTitle.get(target.toLowerCase());
+        if (t && t.id !== d.id) link(d.id, t.id);
+      }
+    }
+    const seen = new Set(titleMatches.map((d) => d.id));
+    let frontier = titleMatches.map((d) => d.id);
+    for (let depth = 0; depth < hops && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        for (const nb of adj.get(id) ?? []) {
+          if (seen.has(nb)) continue;
+          seen.add(nb);
+          const doc = byId.get(nb);
+          if (!doc || !isVisible(doc)) continue;
+          next.push(nb);
+          titleMatches.push(doc);
+        }
+      }
+      frontier = next;
+      hopsUsed = Math.max(hopsUsed, depth + 1);
+    }
+    nodesTraversed += seen.size;
+  }
   if (titleMatches.length > 0) {
     const seen = new Set(documents.map((d) => d.id));
     for (const t of titleMatches) {
@@ -3228,9 +3517,9 @@ queryRoutes.post("/context", async (c) => {
     }
   }
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
+  const userEmail = await resolveCallerEmail(userId);
   const beforePermission = documents.length;
-  const accessible = filterAccessible(nestId, userId, userEmail, documents);
+  const accessible = await filterAccessible(nestId, userId, userEmail, documents);
   const permissionFiltered = beforePermission - accessible.length;
   const readable = await Promise.all(
     accessible.map(async (doc) => ({
@@ -3289,13 +3578,13 @@ queryRoutes.post("/query", async (c) => {
     throw new ValidationError("query is required");
   }
   const nestId = c.req.param("nestId");
-  const { query: queryEngine } = engineCache.get(nestId);
+  const { query: queryEngine } = await engineCache.get(nestId);
   const result = await queryEngine.query(body.query, {
     hops: body.hops ?? 2
   });
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, result.documents);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, result.documents);
   return c.json({
     query: body.query,
     count: accessible.length,
@@ -3314,7 +3603,7 @@ queryRoutes.get("/search", async (c) => {
     throw new ValidationError("q query parameter is required");
   }
   const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const documents = await storage.discoverDocuments();
   const terms = q.toLowerCase().split(/\s+/).filter(Boolean);
   const matches = documents.filter((node) => {
@@ -3327,8 +3616,8 @@ queryRoutes.get("/search", async (c) => {
     return terms.every((term) => haystack.includes(term));
   });
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, matches);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, matches);
   return c.json({
     query: q,
     count: accessible.length,
@@ -3342,7 +3631,7 @@ queryRoutes.get("/search", async (c) => {
   });
 });
 queryRoutes.get("/overview", async (c) => {
-  const { storage } = engineCache.get(c.req.param("nestId"));
+  const { storage } = await engineCache.get(c.req.param("nestId"));
   const documents = await storage.discoverDocuments();
   const types = {};
   const tags = {};
@@ -3366,8 +3655,12 @@ queryRoutes.get("/overview", async (c) => {
     }))
   });
 });
+queryRoutes.get("/comment-counts", async (c) => {
+  const counts = await countThreadsByNode(c.req.param("nestId"));
+  return c.json({ counts });
+});
 queryRoutes.get("/context", async (c) => {
-  const { storage } = engineCache.get(c.req.param("nestId"));
+  const { storage } = await engineCache.get(c.req.param("nestId"));
   const content = await storage.readContextMd();
   return c.json({ content: content || "" });
 });
@@ -3376,7 +3669,7 @@ queryRoutes.get("/export", async (c) => {
     throw new ValidationError("format=markdown is required");
   }
   const nestId = c.req.param("nestId");
-  const { storage, query: queryEngine } = engineCache.get(nestId);
+  const { storage, query: queryEngine } = await engineCache.get(nestId);
   const selector = c.req.query("selector")?.trim() || null;
   let documents;
   if (selector) {
@@ -3386,9 +3679,9 @@ queryRoutes.get("/export", async (c) => {
     documents = await storage.discoverDocuments();
   }
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, documents);
-  const governed = isStewardshipEnabled(nestId);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, documents);
+  const governed = await isStewardshipEnabled(nestId);
   const resolved = await Promise.all(
     accessible.map(async (n) => {
       const body = await resolveExportBody(nestId, n.id, n.body || "");
@@ -3435,7 +3728,7 @@ queryRoutes.post("/publish", async (c) => {
     throw new ValidationError("documents array or context_md is required");
   }
   const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const created = [];
   if (body.context_md) {
     await storage.writeContextMd(body.context_md);
@@ -3467,7 +3760,7 @@ queryRoutes.post("/publish", async (c) => {
     };
     const serialized = serializeDocument2(node);
     await storage.writeDocument(id, serialized);
-    syncNodeTags(nestId, id, tags);
+    await syncNodeTags(nestId, id, tags);
     created.push(id);
   }
   trackEvent("nest.publish", { nestId, count: created.length });
@@ -3487,6 +3780,13 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
 // src/mcp/tools.ts
+var MAX_HOPS = 10;
+function normalizeHops(raw) {
+  if (raw == null) return 2;
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return 2;
+  return Math.max(0, Math.min(MAX_HOPS, Math.floor(n)));
+}
 var TOOL_DEFINITIONS = [
   {
     name: "context_init",
@@ -3515,7 +3815,11 @@ var TOOL_DEFINITIONS = [
     inputSchema: {
       type: "object",
       properties: {
-        query: { type: "string", description: "Selector query" }
+        query: { type: "string", description: "Selector query" },
+        hops: {
+          type: "number",
+          description: "Graph traversal depth from the matched nodes (default: 2). Use 1 for just the matches + direct links, higher to pull in more of the neighborhood."
+        }
       },
       required: ["query"]
     }
@@ -3556,11 +3860,39 @@ var TOOL_DEFINITIONS = [
         max_tokens: {
           type: "number",
           description: "Approximate token budget (default: 8000)"
+        },
+        hops: {
+          type: "number",
+          description: "Graph traversal depth from the matched nodes (default: 2)"
         }
       },
       required: ["selector"]
     }
   },
+  {
+    name: "context_export",
+    description: "Export the ENTIRE nest as one markdown bundle \u2014 every accessible document's FULL content. Use when you need the whole nest as context rather than a targeted query. Respects an optional token budget.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        max_tokens: {
+          type: "number",
+          description: "Approximate token budget; documents are included until it's reached (omit for no cap)."
+        }
+      }
+    }
+  },
+  {
+    name: "context_comments",
+    description: "Get the review comments/annotations on a document \u2014 anchored quotes, threaded replies, and open/resolved status \u2014 by title or ID. Use to pull human feedback into context.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" }
+      }
+    }
+  },
   {
     name: "context_create",
     description: "Create a new knowledge node in the vault.",
@@ -3581,7 +3913,11 @@ var TOOL_DEFINITIONS = [
           items: { type: "string" },
           description: "Tags"
         },
-        scope: { type: "string", description: "Visibility scope" }
+        scope: { type: "string", description: "Visibility scope" },
+        folder: {
+          type: "string",
+          description: 'Folder path under nodes/ (e.g. "gtm/deals"); segments are slugified'
+        }
       },
       required: ["title", "content"]
     }
@@ -3737,8 +4073,8 @@ var TOOL_DEFINITIONS = [
   }
 ];
 async function resolveLlmBody(ctx, node) {
-  if (!isStewardshipEnabled(ctx.nestId)) return node.body || "";
-  const approved = getApprovedVersion(ctx.nestId, node.id);
+  if (!await isStewardshipEnabled(ctx.nestId)) return node.body || "";
+  const approved = await getApprovedVersion(ctx.nestId, node.id);
   if (approved == null) return null;
   try {
     return await ctx.versionManager.reconstructVersion(node.id, approved);
@@ -3812,8 +4148,16 @@ ${nodeList}`;
 ${results}`;
     }
     case "context_query": {
-      const result = await queryEngine.query(args.query, { hops: 2 });
-      const nodes = result.documents;
+      const result = await queryEngine.query(args.query, {
+        hops: normalizeHops(args.hops)
+      });
+      const visibility = await Promise.all(
+        result.documents.map(async (n) => ({
+          node: n,
+          visible: await resolveLlmBody(ctx, n) !== null
+        }))
+      );
+      const nodes = visibility.filter((e) => e.visible).map((e) => e.node);
       if (!nodes.length) return `No nodes matched: ${args.query}`;
       const list = nodes.map(
         (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}`
@@ -3861,23 +4205,101 @@ ${body || "(no content)"}`;
 ${list}`;
     }
     case "context_resolve": {
-      const result = await queryEngine.query(args.selector, { hops: 2 });
+      const result = await queryEngine.query(args.selector, {
+        hops: normalizeHops(args.hops)
+      });
       const maxTokens = args.max_tokens || 8e3;
       const approxChars = maxTokens * 4;
+      const resolvedBodies = await Promise.all(
+        result.documents.map(async (n) => ({
+          node: n,
+          body: await resolveLlmBody(ctx, n)
+        }))
+      );
       let total = 0;
       const resolved = [];
-      for (const n of result.documents) {
+      for (const { node: n, body } of resolvedBodies) {
+        if (body === null) continue;
         const entry = `## ${n.frontmatter.title}
 
-${n.body || ""}`;
+${body}`;
         if (total + entry.length > approxChars) break;
         resolved.push(entry);
         total += entry.length;
       }
       return resolved.join("\n\n---\n\n") || "No nodes resolved.";
     }
+    case "context_export": {
+      const docs = await storage.discoverDocuments();
+      const approxChars = args.max_tokens ? args.max_tokens * 4 : Infinity;
+      const resolved = await Promise.all(
+        docs.map(async (n) => ({ node: n, body: await resolveLlmBody(ctx, n) }))
+      );
+      let total = 0;
+      let budgetHit = false;
+      const parts = [];
+      for (const { node: n, body } of resolved) {
+        if (body === null) continue;
+        const meta = [
+          `**Title:** ${n.frontmatter.title}`,
+          `**Type:** ${n.frontmatter.type || "document"}`,
+          n.frontmatter.tags?.length ? `**Tags:** ${n.frontmatter.tags.join(" ")}` : null
+        ].filter(Boolean).join("\n");
+        const entry = `${meta}
+
+${body || "(no content)"}`;
+        if (total + entry.length > approxChars) {
+          budgetHit = true;
+          break;
+        }
+        parts.push(entry);
+        total += entry.length;
+      }
+      if (!parts.length) {
+        return budgetHit ? "Token budget reached before any document fit \u2014 raise max_tokens, or use context_query/context_resolve to target." : "No documents available to export.";
+      }
+      const note = budgetHit ? `
+
+_(Token budget reached \u2014 ${parts.length} of ${docs.length} documents included. Raise max_tokens, or use context_query/context_resolve to target.)_` : "";
+      return `# Nest export \u2014 ${parts.length} document(s)
+
+${parts.join(
+        "\n\n---\n\n"
+      )}${note}`;
+    }
+    case "context_comments": {
+      const docs = await storage.discoverDocuments();
+      let node;
+      if (args.title) {
+        node = docs.find(
+          (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+        );
+      } else if (args.id) {
+        node = docs.find((n) => n.id === args.id);
+      }
+      if (!node) return `Node not found: ${args.title || args.id}`;
+      if (await resolveLlmBody(ctx, node) === null) {
+        return `Node "${node.frontmatter.title}" has no approved version yet \u2014 not available to AI.`;
+      }
+      const threads = await listThreads(nestId, node.id);
+      if (!threads.length)
+        return `No comments on "${node.frontmatter.title}".`;
+      const openCount = threads.filter((t) => t.status === "open").length;
+      const sections = threads.map((t, i) => {
+        const quote = t.anchor?.quote ? `> ${t.anchor.quote.replace(/\n/g, " ")}
+
+` : "";
+        const head = `### ${i + 1}. [${t.status}]${t.anchor?.quote ? "" : " (whole-document)"}`;
+        const comments = t.comments.map((c) => `- **${c.author}** (${c.createdAt}): ${c.body}`).join("\n");
+        return `${head}
+${quote}${comments}`;
+      }).join("\n\n");
+      return `# Comments on "${node.frontmatter.title}" \u2014 ${threads.length} thread(s), ${openCount} open
+
+${sections}`;
+    }
     case "context_create": {
-      if (!canCreateInNest(nestId, userEmail)) {
+      if (!await canCreateInNest(nestId, userEmail)) {
         return "You don't have permission to create documents in this nest.";
       }
       const { node } = await createNode(
@@ -3887,7 +4309,8 @@ ${n.body || ""}`;
           content: args.content,
           type: args.type,
           tags: args.tags,
-          scope: args.scope
+          scope: args.scope,
+          folder: args.folder
         },
         userEmail
       );
@@ -3899,7 +4322,7 @@ ${n.body || ""}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const editCheck = canUserEdit(nestId, node.id, userEmail);
+      const editCheck = await canUserEdit(nestId, node.id, userEmail);
       if (!editCheck.allowed) {
         return `You don't have permission to edit "${args.title}": ${editCheck.reason}`;
       }
@@ -3923,7 +4346,7 @@ ${n.body || ""}`;
           (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
         );
         const nodeId = node?.id || "";
-        const resolved = resolveStewardsForNode(ctx.nestId, nodeId);
+        const resolved = await resolveStewardsForNode(ctx.nestId, nodeId);
         if (resolved.length === 0) {
           return `No stewards configured for "${args.title}". Changes are auto-approved.`;
         }
@@ -3934,8 +4357,8 @@ ${n.body || ""}`;
 
 ${list}`;
       }
-      if (!canManageStewards(ctx.userEmail)) {
-        return "You don't have permission to list stewards. Only the super admin can do this.";
+      if (!await canManageStewards(ctx.nestId, ctx.userId)) {
+        return "You don't have permission to list stewards. Only a nest admin, the nest owner, or the server admin can do this.";
       }
       const allStewards = await getStewardsForNest(ctx.nestId);
       if (allStewards.length === 0) {
@@ -3979,14 +4402,14 @@ ${list}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const submitCheck = canUserEdit(ctx.nestId, node.id, userEmail);
+      const submitCheck = await canUserEdit(ctx.nestId, node.id, userEmail);
       if (!submitCheck.allowed) {
         return `You don't have permission to submit "${args.title}" for review: ${submitCheck.reason}`;
       }
-      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       if (currentVersion === 0) return `No versions found for "${args.title}"`;
       try {
-        const request = submitForReview({
+        const request = await submitForReview({
           nestId: ctx.nestId,
           nodeId: node.id,
           version: currentVersion,
@@ -3994,7 +4417,7 @@ ${list}`;
           note: args.note,
           priority: args.priority
         });
-        const resolved = resolveStewardsForNode(
+        const resolved = await resolveStewardsForNode(
           ctx.nestId,
           node.id
         );
@@ -4013,7 +4436,7 @@ ${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       try {
         const request = await approve({
           nestId: ctx.nestId,
@@ -4034,9 +4457,9 @@ Note: ${args.note}` : ""}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       try {
-        const request = reject({
+        const request = await reject({
           nestId: ctx.nestId,
           nodeId: node.id,
           version: currentVersion,
@@ -4055,8 +4478,8 @@ Reason: ${args.note}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const allVersions = getVersions(ctx.nestId, node.id);
-      const approved = getApprovedVersion(ctx.nestId, node.id);
+      const allVersions = await getVersions(ctx.nestId, node.id);
+      const approved = await getApprovedVersion(ctx.nestId, node.id);
       if (allVersions.length === 0) {
         return `No version history for "${args.title}".`;
       }
@@ -4073,8 +4496,8 @@ ${list}`;
       if (!["nest", "tag", "document"].includes(scope)) {
         return `Invalid scope "${args.scope}". Use: nest, tag, or document.`;
       }
-      if (!canManageStewards(ctx.userEmail)) {
-        return "You don't have permission to manage stewards. Only the super admin can do this.";
+      if (!await canManageStewards(ctx.nestId, ctx.userId)) {
+        return "You don't have permission to manage stewards. Only a nest admin, the nest owner, or the server admin can do this.";
       }
       try {
         await createStewardRecord({
@@ -4092,9 +4515,9 @@ ${list}`;
       }
     }
     case "context_share_nest": {
-      const roles = resolveUserRoles(ctx.nestId, ctx.userEmail);
-      if (!canManageWith(roles)) {
-        return "You don't have permission to share this nest via this tool (admin only). You can still invite from the UI with write access, or ask a nest admin.";
+      const callerPermission = config.AUTH_MODE === "open" ? "owner" : await resolveNestPermission(ctx.nestId, ctx.userId);
+      if (permissionLevel(callerPermission) < permissionLevel("write")) {
+        return "You don't have permission to share this nest. Sharing needs write access \u2014 ask a nest admin or the owner.";
       }
       const permission = args.permission || "read";
       try {
@@ -4102,7 +4525,8 @@ ${list}`;
           nestId: ctx.nestId,
           email: args.email,
           permission,
-          grantedByEmail: ctx.userEmail
+          grantedByEmail: ctx.userEmail,
+          callerPermission
         });
         const label = permission === "admin" ? "admin" : permission === "write" ? "editor" : "viewer";
         return `Shared this nest with **${args.email}** as ${label}.`;
@@ -4111,7 +4535,7 @@ ${list}`;
       }
     }
     case "context_unsynced_list": {
-      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+      if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
         return "You don't have permission to list unsynced folders. Server admin only.";
       }
       const folders = listUnsyncedFolders();
@@ -4124,7 +4548,7 @@ ${list}`;
 ${list}`;
     }
     case "context_sync_folder": {
-      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+      if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
         return "You don't have permission to sync folders. Server admin only.";
       }
       try {
@@ -4146,9 +4570,9 @@ ${list}`;
 // src/mcp/routes.ts
 import { z } from "zod";
 var mcpRoutes = new Hono7();
-function getUserEmail2(userId) {
+async function getUserEmail2(userId) {
   const db = getDb();
-  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
   return user?.email || "anonymous@localhost";
 }
 function createMcpServerForNest(nestId, userId, userEmail) {
@@ -4156,7 +4580,6 @@ function createMcpServerForNest(nestId, userId, userEmail) {
     { name: `contextnest-${nestId}`, version: "1.0.0" },
     { capabilities: { tools: {} } }
   );
-  const engine = engineCache.get(nestId);
   for (const tool of TOOL_DEFINITIONS) {
     const props = tool.inputSchema.properties || {};
     const required = tool.inputSchema.required || [];
@@ -4171,6 +4594,7 @@ function createMcpServerForNest(nestId, userId, userEmail) {
       shape[key] = field;
     }
     server.tool(tool.name, tool.description, shape, async (args) => {
+      const engine = await engineCache.get(nestId);
       const text = await handleToolCall(tool.name, args, {
         storage: engine.storage,
         queryEngine: engine.query,
@@ -4187,7 +4611,7 @@ function createMcpServerForNest(nestId, userId, userEmail) {
 mcpRoutes.all("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const userEmail = getUserEmail2(userId);
+  const userEmail = await getUserEmail2(userId);
   const server = createMcpServerForNest(nestId, userId, userEmail);
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: void 0,
@@ -4208,41 +4632,43 @@ import { Hono as Hono8 } from "hono";
 
 // src/governance/comment-service.ts
 import { v4 as uuid4 } from "uuid";
-function createComment(params) {
+async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
   if (!body) {
     throw new Error("Comment body is required");
   }
   if (params.parentId) {
-    const parent = db.prepare(
-      "SELECT id FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
-    ).get(params.parentId, params.nestId, params.nodeId);
+    const parent = await db.get(
+      "SELECT id FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?",
+      [params.parentId, params.nestId, params.nodeId]
+    );
     if (!parent) {
       throw new Error("Parent comment not found on this node");
     }
   }
   const id = uuid4();
-  db.prepare(
+  await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
         parent_id, author, body)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    id,
-    params.nestId,
-    params.nodeId,
-    params.version ?? null,
-    params.anchor?.start ?? null,
-    params.anchor?.end ?? null,
-    params.anchor?.text ?? null,
-    params.parentId ?? null,
-    params.author,
-    body
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [
+      id,
+      params.nestId,
+      params.nodeId,
+      params.version ?? null,
+      params.anchor?.start ?? null,
+      params.anchor?.end ?? null,
+      params.anchor?.text ?? null,
+      params.parentId ?? null,
+      params.author,
+      body
+    ]
   );
-  return getComment(id);
+  return await getComment(id);
 }
-function listComments(nestId, nodeId, opts = {}) {
+async function listComments(nestId, nodeId, opts = {}) {
   const db = getDb();
   const args = [nestId, nodeId];
   let statusClause = "";
@@ -4250,35 +4676,38 @@ function listComments(nestId, nodeId, opts = {}) {
     statusClause = " AND status = ?";
     args.push(opts.status);
   }
-  const rows = db.prepare(
+  const rows = await db.all(
     `SELECT * FROM comments
         WHERE nest_id = ? AND node_id = ?${statusClause}
-        ORDER BY created_at ASC`
-  ).all(...args);
+        ORDER BY created_at ASC`,
+    args
+  );
   return rows.map(rowToComment);
 }
-function getComment(id) {
+async function getComment(id) {
   const db = getDb();
-  const row = db.prepare("SELECT * FROM comments WHERE id = ?").get(id);
+  const row = await db.get("SELECT * FROM comments WHERE id = ?", [id]);
   return row ? rowToComment(row) : null;
 }
-function resolveComment(params) {
+async function resolveComment(params) {
   const db = getDb();
-  const existing = db.prepare(
-    "SELECT id, status FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
-  ).get(params.commentId, params.nestId, params.nodeId);
+  const existing = await db.get(
+    "SELECT id, status FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?",
+    [params.commentId, params.nestId, params.nodeId]
+  );
   if (!existing) {
     throw new Error("Comment not found");
   }
   if (existing.status === "resolved") {
     throw new Error("Comment is already resolved");
   }
-  db.prepare(
+  await db.run(
     `UPDATE comments
-        SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now')
-      WHERE id = ?`
-  ).run(params.resolvedBy, params.commentId);
-  return getComment(params.commentId);
+        SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)}
+      WHERE id = ?`,
+    [params.resolvedBy, params.commentId]
+  );
+  return await getComment(params.commentId);
 }
 async function getActivity(params) {
   const db = getDb();
@@ -4286,13 +4715,14 @@ async function getActivity(params) {
   const entries = [];
   const nodeFilter = params.nodeId ? " AND node_id = ?" : "";
   const baseArgs = params.nodeId ? [params.nestId, params.nodeId] : [params.nestId];
-  const commentRows = db.prepare(
+  const commentRows = await db.all(
     `SELECT id, node_id, author, body, status, created_at, resolved_by, resolved_at
          FROM comments
         WHERE nest_id = ?${nodeFilter}
         ORDER BY COALESCE(resolved_at, created_at) DESC
-        LIMIT ?`
-  ).all(...baseArgs, limit);
+        LIMIT ?`,
+    [...baseArgs, limit]
+  );
   for (const r of commentRows) {
     entries.push({
       type: "comment",
@@ -4313,13 +4743,14 @@ async function getActivity(params) {
       });
     }
   }
-  const versionRows = db.prepare(
+  const versionRows = await db.all(
     `SELECT node_id, version, author, change_note, created_at
          FROM node_versions
         WHERE nest_id = ?${nodeFilter}
         ORDER BY created_at DESC
-        LIMIT ?`
-  ).all(...baseArgs, limit);
+        LIMIT ?`,
+    [...baseArgs, limit]
+  );
   for (const r of versionRows) {
     entries.push({
       type: "edit",
@@ -4330,13 +4761,14 @@ async function getActivity(params) {
       refId: String(r.version)
     });
   }
-  const reviewRows = db.prepare(
+  const reviewRows = await db.all(
     `SELECT id, node_id, requested_by, requested_at, status, resolved_by, resolved_at
          FROM review_requests
         WHERE nest_id = ?${nodeFilter}
         ORDER BY COALESCE(resolved_at, requested_at) DESC
-        LIMIT ?`
-  ).all(...baseArgs, limit);
+        LIMIT ?`,
+    [...baseArgs, limit]
+  );
   for (const r of reviewRows) {
     entries.push({
       type: "review_requested",
@@ -4479,8 +4911,7 @@ function parseEntry(str) {
   return entry;
 }
 function loadStewardsConfig(nestId) {
-  const dataRoot = config.DATA_ROOT;
-  const nestPath = join3(dataRoot, "nests", nestId);
+  const nestPath = resolveNestPath(nestId);
   const candidates = [
     join3(nestPath, "stewards.yaml"),
     join3(nestPath, "stewards.yml"),
@@ -4512,24 +4943,25 @@ governanceRoutes.get("/stewards", async (c) => {
     search: search || void 0
   });
   const cache = /* @__PURE__ */ new Map();
-  const enriched = stewards.map((s) => {
+  const enriched = [];
+  for (const s of stewards) {
     const key = s.userEmail.toLowerCase();
     let merged = cache.get(key);
     if (!merged) {
       merged = {
-        collaboratorRole: getCollaboratorRole(nestId, s.userEmail),
-        roles: resolveUserRoles(nestId, s.userEmail)
+        collaboratorRole: await getCollaboratorRole(nestId, s.userEmail),
+        roles: await resolveUserRoles(nestId, s.userEmail)
       };
       cache.set(key, merged);
     }
-    return { ...s, ...merged };
-  });
+    enriched.push({ ...s, ...merged });
+  }
   return c.json({ stewards: enriched });
 });
 governanceRoutes.post("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const body = await c.req.json();
-  const assignedBy = getUserEmail3(c);
+  const assignedBy = await getUserEmail3(c);
   if (!body.scope) throw new ValidationError("scope is required");
   if (body.scope === "folder") {
     throw new ValidationError(
@@ -4571,7 +5003,7 @@ governanceRoutes.patch("/stewards/:stewardId", async (c) => {
   if (!body.role && !body.scope) {
     throw new ValidationError("role or scope is required");
   }
-  const steward = updateSteward(stewardId, {
+  const steward = await updateSteward(stewardId, {
     role: body.role,
     scope: body.scope,
     documentId: body.nodePattern,
@@ -4581,7 +5013,7 @@ governanceRoutes.patch("/stewards/:stewardId", async (c) => {
 });
 governanceRoutes.delete("/stewards/:stewardId", async (c) => {
   const stewardId = c.req.param("stewardId");
-  removeSteward(stewardId);
+  await removeSteward(stewardId);
   return c.json({ removed: true });
 });
 governanceRoutes.post("/stewards/sync", async (c) => {
@@ -4590,7 +5022,7 @@ governanceRoutes.post("/stewards/sync", async (c) => {
   if (!stewardsConfig) {
     return c.json({ synced: 0, message: "No stewards.yaml found" });
   }
-  const count = syncFromConfig(nestId, stewardsConfig);
+  const count = await syncFromConfig(nestId, stewardsConfig);
   return c.json({ synced: count });
 });
 governanceRoutes.get("/review-queue", async (c) => {
@@ -4604,16 +5036,17 @@ governanceRoutes.get("/review-queue", async (c) => {
     limit,
     offset
   });
-  const email = getUserEmail3(c);
+  const email = await getUserEmail3(c);
   const canReviewCache = /* @__PURE__ */ new Map();
-  const requests = result.requests.map((r) => {
+  const requests = [];
+  for (const r of result.requests) {
     let canReview = canReviewCache.get(r.nodeId);
     if (canReview === void 0) {
-      canReview = canUserApprove(nestId, r.nodeId, email).allowed;
+      canReview = (await canUserApprove(nestId, r.nodeId, email)).allowed;
       canReviewCache.set(r.nodeId, canReview);
     }
-    return { ...r, canReview };
-  });
+    requests.push({ ...r, canReview });
+  }
   return c.json({ ...result, requests });
 });
 governanceRoutes.get("/external-edits", async (c) => {
@@ -4627,7 +5060,7 @@ governanceRoutes.get("/external-edits", async (c) => {
 });
 governanceRoutes.post("/external-edits/scan", async (c) => {
   const nestId = c.req.param("nestId");
-  const actor = getUserEmail3(c);
+  const actor = await getUserEmail3(c);
   const result = await scanNestForDrift(nestId, actor);
   return c.json(result);
 });
@@ -4641,7 +5074,7 @@ var governanceNodeRoutes = new Hono8();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { stewards: resolved, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback(nestId, nodeId);
+  const { stewards: resolved, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback(nestId, nodeId);
   return c.json({
     nodeId,
     stewards: resolved.map((r) => ({
@@ -4658,9 +5091,9 @@ governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const allVersions = getVersions(nestId, nodeId);
-  const approved = getApprovedVersion(nestId, nodeId);
-  const { versions: versionManager } = engineCache.get(nestId);
+  const allVersions = await getVersions(nestId, nodeId);
+  const approved = await getApprovedVersion(nestId, nodeId);
+  const { versions: versionManager } = await engineCache.get(nestId);
   const withContent = await Promise.all(
     allVersions.map(async (v) => {
       try {
@@ -4680,14 +5113,14 @@ governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const history = getReviewHistory(nestId, nodeId);
+  const history = await getReviewHistory(nestId, nodeId);
   return c.json({ reviews: history });
 });
 governanceNodeRoutes.get("/:nodeId{.+}/comments", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const status = c.req.query("status");
-  const list = listComments(nestId, nodeId, {
+  const list = await listComments(nestId, nodeId, {
     status: status === "open" || status === "resolved" ? status : void 0
   });
   return c.json({ comments: list });
@@ -4696,9 +5129,9 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const author = getUserEmail3(c);
+  const author = await getUserEmail3(c);
   try {
-    const comment = createComment({
+    const comment = await createComment({
       nestId,
       nodeId,
       author,
@@ -4720,9 +5153,9 @@ governanceNodeRoutes.post(
     const nestId = c.req.param("nestId");
     const nodeId = c.req.param("nodeId");
     const commentId = c.req.param("commentId");
-    const resolvedBy = getUserEmail3(c);
+    const resolvedBy = await getUserEmail3(c);
     try {
-      const comment = resolveComment({
+      const comment = await resolveComment({
         nestId,
         nodeId,
         commentId,
@@ -4749,14 +5182,14 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const currentVersion = getCurrentVersion(nestId, nodeId);
+  const currentVersion = await getCurrentVersion(nestId, nodeId);
   if (currentVersion === 0) {
     throw new ValidationError("Node has no versions to review");
   }
-  const userEmail = getUserEmail3(c);
+  const userEmail = await getUserEmail3(c);
   let request;
   try {
-    request = submitForReview({
+    request = await submitForReview({
       nestId,
       nodeId,
       version: currentVersion,
@@ -4771,7 +5204,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
     }
     throw err;
   }
-  const resolved = resolveStewardsForNode(nestId, nodeId);
+  const resolved = await resolveStewardsForNode(nestId, nodeId);
   return c.json(
     {
       review: request,
@@ -4788,13 +5221,13 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const userEmail = getUserEmail3(c);
+  const userEmail = await getUserEmail3(c);
   const isAdmin = isSuperAdmin(userEmail);
   try {
     const request = await approve({
       nestId,
       nodeId,
-      version: getCurrentVersion(nestId, nodeId),
+      version: await getCurrentVersion(nestId, nodeId),
       approvedBy: userEmail,
       note: body.note,
       override: body.override && isAdmin
@@ -4811,12 +5244,12 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
   if (!body.note) {
     throw new ValidationError("Rejection note is required");
   }
-  const userEmail = getUserEmail3(c);
+  const userEmail = await getUserEmail3(c);
   try {
-    const request = reject({
+    const request = await reject({
       nestId,
       nodeId,
-      version: getCurrentVersion(nestId, nodeId),
+      version: await getCurrentVersion(nestId, nodeId),
       rejectedBy: userEmail,
       note: body.note
     });
@@ -4828,20 +5261,20 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/can-access", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  return c.json(canUserAccess(nestId, nodeId, userEmail));
+  const userEmail = await getUserEmail3(c);
+  return c.json(await canUserAccess(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+}/can-approve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  return c.json(canUserApprove(nestId, nodeId, userEmail));
+  const userEmail = await getUserEmail3(c);
+  return c.json(await canUserApprove(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  return c.json(canUserEdit(nestId, nodeId, userEmail));
+  const userEmail = await getUserEmail3(c);
+  return c.json(await canUserEdit(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+?}/external-edits", async (c) => {
   const nestId = c.req.param("nestId");
@@ -4873,7 +5306,7 @@ governanceNodeRoutes.post(
     const nodeId = c.req.param("nodeId");
     const suggestionId = c.req.param("suggestionId");
     const body = await c.req.json().catch(() => ({}));
-    const actor = getUserEmail3(c);
+    const actor = await getUserEmail3(c);
     try {
       const result = await approveExternalEdit({
         nestId,
@@ -4909,7 +5342,7 @@ governanceNodeRoutes.post(
     if (!body.reason) {
       throw new ValidationError("Rejection reason is required");
     }
-    const actor = getUserEmail3(c);
+    const actor = await getUserEmail3(c);
     try {
       const result = await rejectExternalEdit({
         nestId,
@@ -4930,31 +5363,38 @@ governanceNodeRoutes.post(
 governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  const request = cancelReview({
+  const userEmail = await getUserEmail3(c);
+  const request = await cancelReview({
     nestId,
     nodeId,
     cancelledBy: userEmail
   });
   return c.json({ review: request });
 });
-function getUserEmail3(c) {
+async function getUserEmail3(c) {
   const userId = c.get("userId");
   const db = getDb();
-  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const user = await db.get(
+    "SELECT email FROM users WHERE id = ?",
+    [userId]
+  );
   return user?.email || "anonymous@localhost";
 }
 
 // src/auth/anonymous.ts
 import bcrypt from "bcryptjs";
-function ensureAnonymousUser() {
+async function ensureAnonymousUser() {
   const db = getDb();
-  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID);
+  const exists = await db.get(
+    "SELECT id FROM users WHERE id = ?",
+    [ANON_USER_ID]
+  );
   if (!exists) {
     const placeholder = bcrypt.hashSync("anon-no-login", 4);
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(ANON_USER_ID, ANON_EMAIL, "Admin", placeholder);
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+      [ANON_USER_ID, ANON_EMAIL, "Admin", placeholder]
+    );
   }
   return ANON_USER_ID;
 }
@@ -4972,7 +5412,7 @@ var UI_DIR_CANDIDATES = [
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
-  const anonId = ensureAnonymousUser();
+  const anonId = await ensureAnonymousUser();
   c.set("userId", anonId);
   c.set("nestScope", null);
   await next();
@@ -4980,6 +5420,7 @@ var openModeMiddleware = createMiddleware2(async (c, next) => {
 function isPublicReadEligiblePath(method, path) {
   if (method !== "GET") return false;
   if (!/^\/nests\/[^/]+(\/.*)?$/.test(path)) return false;
+  if (/^\/nests\/[^/]+\/stewards/.test(path)) return false;
   return !/\/(collaborators|visibility|settings|mcp)/.test(path);
 }
 var flexAuthMiddleware = createMiddleware2(async (c, next) => {
@@ -4989,13 +5430,13 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
     return authMiddleware(c, next);
   }
   if (config.AUTH_MODE === "open") {
-    const anonId = ensureAnonymousUser();
+    const anonId = await ensureAnonymousUser();
     c.set("userId", anonId);
     c.set("nestScope", null);
     return next();
   }
   if (isPublicReadEligiblePath(c.req.method, c.req.path)) {
-    const anonId = ensureAnonymousUser();
+    const anonId = await ensureAnonymousUser();
     c.set("userId", anonId);
     c.set("nestScope", null);
     return next();
@@ -5117,7 +5558,7 @@ function createApp() {
     }
   });
   app.use("/admin/settings", flexAuthMiddleware);
-  const adminSettingsAllowed = (c) => config.AUTH_MODE === "open" || isLicenseAdminUserId(c.get("userId"));
+  const adminSettingsAllowed = async (c) => config.AUTH_MODE === "open" || await isLicenseAdminUserId(c.get("userId"));
   const currentServerSettings = () => ({
     promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
     logo_url: config.LOGO_URL,
@@ -5125,13 +5566,13 @@ function createApp() {
     public_base_url: config.PUBLIC_BASE_URL,
     max_body_bytes: config.MAX_BODY_BYTES
   });
-  app.get("/admin/settings", (c) => {
-    if (!adminSettingsAllowed(c))
+  app.get("/admin/settings", async (c) => {
+    if (!await adminSettingsAllowed(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     return c.json(currentServerSettings());
   });
   app.patch("/admin/settings", async (c) => {
-    if (!adminSettingsAllowed(c))
+    if (!await adminSettingsAllowed(c))
       return c.json({ error: "Only the server admin can change this." }, 403);
     let body;
     try {
@@ -5187,18 +5628,22 @@ function createApp() {
   app.get("/stats", async (c) => {
     const db = getDb();
     const userId = c.get("userId");
-    const userEmail = resolveCallerEmail(userId);
-    const visibleNests = [...listNests(userId), ...listSharedNests(userId)];
+    const userEmail = await resolveCallerEmail(userId);
+    const owned = await listNests(userId);
+    const sharedNests = await listSharedNests(userId);
+    const visibleNests = [...owned, ...sharedNests];
     let documents = 0;
     for (const nest of visibleNests) {
       try {
-        const { storage } = engineCache.get(nest.id);
+        const { storage } = await engineCache.get(nest.id);
         const docs = await storage.discoverDocuments();
-        documents += filterAccessible(nest.id, userId, userEmail, docs).length;
+        documents += (await filterAccessible(nest.id, userId, userEmail, docs)).length;
       } catch {
       }
     }
-    const usersRow = db.prepare("SELECT COUNT(*) as c FROM users").get();
+    const usersRow = await db.get(
+      "SELECT COUNT(*) as c FROM users"
+    );
     return c.json({
       nests: visibleNests.length,
       documents,
@@ -5252,7 +5697,7 @@ function createApp() {
       c.set("nestPermission", "owner");
       return next();
     }
-    const permission = resolveNestPermission(nestId, userId);
+    const permission = await resolveNestPermission(nestId, userId);
     if (permission === "none") {
       return c.json({ error: "Nest not found" }, 404);
     }
@@ -5262,10 +5707,10 @@ function createApp() {
     const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
-    if (isStewardRoster && !canManageStewards(resolveCallerEmail(userId))) {
+    if (isStewardRoster && permission !== "owner" && permission !== "admin") {
       return c.json(
         {
-          error: "You don't have permission to manage stewards. Only the super admin can do this."
+          error: "You don't have permission to manage stewards. Only a nest admin, the nest owner, or the server admin can do this."
         },
         403
       );
@@ -5281,7 +5726,7 @@ function createApp() {
     const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
     let stewardEditorBypass = false;
     if (required === "write" && permission === "read" && parts[1] === "nodes") {
-      const userEmail = resolveCallerEmail(userId);
+      const userEmail = await resolveCallerEmail(userId);
       if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE" || isNodeRevert)) {
         const idParts = isNodeRevert ? parts.slice(2, -1) : parts.slice(2);
         const rawNodeId = idParts.join("/");
@@ -5290,12 +5735,12 @@ function createApp() {
           nodeId = decodeURIComponent(rawNodeId);
         } catch {
         }
-        const resolved = resolveStewardsForNode(nestId, nodeId);
+        const resolved = await resolveStewardsForNode(nestId, nodeId);
         stewardEditorBypass = resolved.some(
           (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor"
         );
       } else if (parts.length === 2 && c.req.method === "POST") {
-        const resolved = resolveStewardsForNode(nestId, "");
+        const resolved = await resolveStewardsForNode(nestId, "");
         stewardEditorBypass = resolved.some(
           (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && r.steward.scope === "nest"
         );
@@ -5403,28 +5848,30 @@ function createApp() {
 
 // src/db/backfill.ts
 import { NestStorage } from "@promptowl/contextnest-engine";
-import { join as join5 } from "path";
 var MIGRATION_ID = "005_backfill_node_versions_from_history";
 async function backfillNodeVersionsFromHistory(db) {
-  const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
+  const already = await db.get(
+    "SELECT id FROM schema_migrations WHERE id = ?",
+    [MIGRATION_ID]
+  );
   if (already) return;
-  const nests = db.prepare("SELECT id FROM nests").all();
-  const insert = db.prepare(
-    `INSERT OR IGNORE INTO node_versions
+  const nests = await db.all("SELECT id FROM nests");
+  const insertSql = insertOrIgnore(
+    db,
+    `INSERT INTO node_versions
        (nest_id, node_id, version, content_hash, author, status, change_note, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
   );
-  const approvedPin = db.prepare(
-    `INSERT OR REPLACE INTO approved_versions
+  const approvedPinSql = `INSERT INTO approved_versions
        (nest_id, node_id, approved_version, approved_by, approved_at)
-     VALUES (?, ?, ?, ?, COALESCE(
-       (SELECT approved_at FROM approved_versions WHERE nest_id = ? AND node_id = ?),
-       datetime('now')))`
-  );
+     VALUES (?, ?, ?, ?, ${nowExpr(db)})
+     ON CONFLICT (nest_id, node_id) DO UPDATE SET
+       approved_version = excluded.approved_version,
+       approved_by = excluded.approved_by`;
   let totalInserted = 0;
   let totalDocs = 0;
   for (const { id: nestId } of nests) {
-    const nestPath = join5(config.DATA_ROOT, "nests", nestId);
+    const nestPath = resolveNestPath(nestId);
     const storage = new NestStorage(nestPath);
     let docs;
     try {
@@ -5445,15 +5892,16 @@ async function backfillNodeVersionsFromHistory(db) {
         history = null;
       }
       if (!history || history.versions.length === 0) continue;
-      const existing = db.prepare(
-        `SELECT version FROM node_versions WHERE nest_id = ? AND node_id = ?`
-      ).all(nestId, doc.id);
+      const existing = await db.all(
+        `SELECT version FROM node_versions WHERE nest_id = ? AND node_id = ?`,
+        [nestId, doc.id]
+      );
       const known = new Set(existing.map((r) => r.version));
       const tagsJson = doc.frontmatter.tags ? JSON.stringify(doc.frontmatter.tags) : null;
       const latestVersion = history.versions[history.versions.length - 1].version;
       for (const entry of history.versions) {
         if (known.has(entry.version)) continue;
-        insert.run(
+        await db.run(insertSql, [
           nestId,
           doc.id,
           entry.version,
@@ -5462,33 +5910,33 @@ async function backfillNodeVersionsFromHistory(db) {
           "approved",
           entry.note || null,
           entry.edited_at || (/* @__PURE__ */ new Date()).toISOString()
-        );
+        ]);
         totalInserted += 1;
       }
-      const pin = db.prepare(
-        `SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?`
-      ).get(nestId, doc.id);
+      const pin = await db.get(
+        `SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?`,
+        [nestId, doc.id]
+      );
       if (!pin || pin.approved_version < latestVersion) {
-        approvedPin.run(
+        await db.run(approvedPinSql, [
           nestId,
           doc.id,
           latestVersion,
-          history.versions[history.versions.length - 1].edited_by || "system:backfill",
-          nestId,
-          doc.id
-        );
+          history.versions[history.versions.length - 1].edited_by || "system:backfill"
+        ]);
       }
       if (tagsJson) {
-        const updateTags = db.prepare(
+        await db.run(
           `UPDATE node_versions SET tags_json = ?
-           WHERE nest_id = ? AND node_id = ? AND version = ? AND tags_json IS NULL`
+           WHERE nest_id = ? AND node_id = ? AND version = ? AND tags_json IS NULL`,
+          [tagsJson, nestId, doc.id, latestVersion]
         );
-        updateTags.run(tagsJson, nestId, doc.id, latestVersion);
       }
     }
   }
-  db.prepare("INSERT OR IGNORE INTO schema_migrations (id) VALUES (?)").run(
-    MIGRATION_ID
+  await db.run(
+    insertOrIgnore(db, "INSERT INTO schema_migrations (id) VALUES (?)"),
+    [MIGRATION_ID]
   );
   console.log(
     `[backfill] node_versions: scanned ${totalDocs} docs across ${nests.length} nests, inserted ${totalInserted} rows`
@@ -5497,7 +5945,7 @@ async function backfillNodeVersionsFromHistory(db) {
 
 // src/index.ts
 async function main() {
-  const db = getDb();
+  const db = await initDb();
   try {
     await backfillNodeVersionsFromHistory(db);
   } catch (err) {
@@ -5531,7 +5979,8 @@ async function main() {
   }
   const app = createApp();
   startLicenseSafetyPoll();
-  const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;
+  const driftRaw = process.env.DRIFT_SCAN_INTERVAL_MS;
+  const driftScanIntervalMs = driftRaw != null && driftRaw !== "" && Number.isFinite(Number(driftRaw)) ? Number(driftRaw) : 3e4;
   if (driftScanIntervalMs > 0) {
     startDriftScanner(driftScanIntervalMs);
   }
@@ -5542,11 +5991,13 @@ async function main() {
     licensed: license.valid
   });
   const authDesc = config.AUTH_MODE === "open" ? "open (no auth \u2014 single-user / LAN only)" : "key (API key required on every request)";
+  const dbDesc = db.dialect === "postgres" ? `postgres (${config.CLOUD_SQL_CONNECTION_NAME ? `cloudsql ${config.CLOUD_SQL_CONNECTION_NAME}` : config.DATABASE_URL ? "DATABASE_URL" : `${config.DB_HOST || "localhost"}:${config.DB_PORT}/${config.DB_NAME}`})` : `sqlite (${config.DATABASE_PATH})`;
   console.log(`
   ContextNest Community Server v0.1.0
   \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   Port:      ${config.PORT}
   Data:      ${config.DATA_ROOT}
+  Database:  ${dbDesc}
   License:   ${license.valid ? `${license.tier}${license.org ? ` (${license.org})` : ""}` : "unlicensed (register at promptowl.ai)"}
   Auth:      ${authDesc}
   Telemetry: ${config.TELEMETRY_ENABLED ? "on" : "off"}